urlscan.io logo urlscan.io
SecurityTrails logo

www.mercurynews.com Open in urlscan Pro
192.0.66.2  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tell...
Submission: On June 20 via api from US — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 178 IPs in 12 countries across 175 domains to perform 994 HTTP transactions. The main IP is 192.0.66.2, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is www.mercurynews.com. The Cisco Umbrella rank of the primary domain is 65849.
TLS certificate: Issued by R3 on May 21st 2023. Valid for: 3 months.
This is the only time www.mercurynews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
27 192.0.66.2 2635 (AUTOMATTIC)
2 13.33.60.24 16509 (AMAZON-02)
3 2a04:4e42::485 54113 (FASTLY)
5 2607:f8b0:402... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
1 2600:9000:251... 16509 (AMAZON-02)
3 2607:f8b0:402... 15169 (GOOGLE)
1 143.204.146.37 16509 (AMAZON-02)
16 18.164.96.113 16509 (AMAZON-02)
3 2600:9000:251... 16509 (AMAZON-02)
1 20.60.62.4 8075 (MICROSOFT...)
2 13.225.214.63 16509 (AMAZON-02)
1 18.164.101.60 16509 (AMAZON-02)
1 2600:9000:21d... 16509 (AMAZON-02)
18 2607:f8b0:400... 15169 (GOOGLE)
2 192.0.76.3 2635 (AUTOMATTIC)
2 2606:2800:11f... 15133 (EDGECAST)
1 2a04:4e42:600... 54113 (FASTLY)
4 52.40.223.220 16509 (AMAZON-02)
3 52.200.130.143 14618 (AMAZON-AES)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
42 151.101.193.44 54113 (FASTLY)
5 2607:f8b0:400... 15169 (GOOGLE)
8 2607:f8b0:402... 15169 (GOOGLE)
1 54.144.144.142 14618 (AMAZON-AES)
4 35.190.38.143 15169 (GOOGLE)
3 108.138.107.138 16509 (AMAZON-02)
8 2606:2800:11f... 15133 (EDGECAST)
1 2600:1f18:44f... 14618 (AMAZON-AES)
3 192.0.77.48 2635 (AUTOMATTIC)
2 137.184.240.117 14061 (DIGITALOC...)
3 5 2620:116:800b... 14618 (AMAZON-AES)
2 4 207.198.113.205 13768 (COGECO-PEER1)
2 2606:4700:440... 13335 (CLOUDFLAR...)
1 13.35.93.23 16509 (AMAZON-02)
2 6 13.35.93.31 16509 (AMAZON-02)
1 52.55.146.213 14618 (AMAZON-AES)
1 2600:9000:21d... 16509 (AMAZON-02)
1 104.18.25.185 13335 (CLOUDFLAR...)
1 54.164.26.28 14618 (AMAZON-AES)
1 6 44.207.246.26 14618 (AMAZON-AES)
9 2620:100:a001... 19750 (AS-CRITEO)
8 31 68.67.179.113 29990 (ASN-APPNEX)
8 2602:803:c002... 26667 (RUBICONPR...)
9 104.36.115.111 62713 (AS-PUBMATIC)
1 18.164.98.157 16509 (AMAZON-02)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2600:9000:251... 16509 (AMAZON-02)
11 2620:100:a001::4 19750 (AS-CRITEO)
8 18 2620:100:a001::c 19750 (AS-CRITEO)
12 2607:f8b0:402... 15169 (GOOGLE)
2 3 3.215.224.52 14618 (AMAZON-AES)
3 8 34.111.113.62 396982 (GOOGLE-CL...)
3 3 50.16.197.56 14618 (AMAZON-AES)
1 2a02:6ea0:c40... 60068 (CDN77 ^_^)
1 23.200.197.46 16625 (AKAMAI-AS)
2 5 23.20.148.40 14618 (AMAZON-AES)
1 23.37.104.225 16625 (AKAMAI-AS)
1 2 107.178.250.234 15169 (GOOGLE)
2 18.164.116.119 16509 (AMAZON-02)
1 23.54.69.53 16625 (AKAMAI-AS)
2 2600:9000:23c... 16509 (AMAZON-02)
1 2600:9000:220... 16509 (AMAZON-02)
2 34.228.182.143 14618 (AMAZON-AES)
9 10 141.95.98.64 16276 (OVH)
19 2607:f8b0:402... 15169 (GOOGLE)
1 18.164.116.116 16509 (AMAZON-02)
1 104.26.5.15 13335 (CLOUDFLAR...)
1 52.217.193.97 16509 (AMAZON-02)
2 24 52.46.128.147 16509 (AMAZON-02)
4 2a03:2880:f01... 32934 (FACEBOOK)
1 52.217.228.1 16509 (AMAZON-02)
5 54.162.81.74 14618 (AMAZON-AES)
4 3.228.62.117 14618 (AMAZON-AES)
1 3.14.222.105 16509 (AMAZON-02)
1 1 2600:1f18:730... 14618 (AMAZON-AES)
1 3.227.221.232 14618 (AMAZON-AES)
7 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:402... 15169 (GOOGLE)
1 1 23.215.40.23 16625 (AKAMAI-AS)
2 2 2600:9000:220... 16509 (AMAZON-02)
2 52.85.61.61 16509 (AMAZON-02)
2 19 141.226.224.48 200478 (TABOOLA-AS)
1 2 3.234.8.191 14618 (AMAZON-AES)
3 27 192.40.39.223 27381 (CASALE-MEDIA)
2 3 23.105.14.100 30633 (LEASEWEB-...)
8 8 2606:ae80:147... 25751 (VALUECLICK)
10 17 3.223.221.83 14618 (AMAZON-AES)
11 23.54.68.197 16625 (AKAMAI-AS)
1 54.208.104.226 14618 (AMAZON-AES)
18 104.91.103.236 16625 (AKAMAI-AS)
3 7 198.148.27.140 19189 (PULSEPOINT)
1 23.33.238.169 20940 (AKAMAI-ASN1)
2 54.210.26.99 14618 (AMAZON-AES)
7 7 63.251.86.49 32475 (SINGLEHOP...)
1 7 63.251.86.50 10913 (INTERNAP-BLK)
11 3.227.148.228 14618 (AMAZON-AES)
3 6 35.71.139.29 16509 (AMAZON-02)
5 2607:f8b0:400... 15169 (GOOGLE)
11 2607:f8b0:400... 15169 (GOOGLE)
5 8 68.67.160.26 29990 (ASN-APPNEX)
1 19 3.214.33.241 14618 (AMAZON-AES)
29 29 35.211.178.172 15169 (GOOGLE)
2 3 34.204.237.207 14618 (AMAZON-AES)
3 3 54.163.224.69 14618 (AMAZON-AES)
8 8 64.202.112.191 22075 (AS-OUTBRAIN)
5 6 23.192.32.8 16625 (AKAMAI-AS)
3 4 70.42.32.63 13789 (INTERNAP-...)
7 16 35.244.159.8 15169 (GOOGLE)
3 9 2600:1f18:4e9... 14618 (AMAZON-AES)
2 2 50.16.251.137 14618 (AMAZON-AES)
2 2 2603:c020:400... 31898 (ORACLE-BM...)
1 2 169.197.150.8 398989 (DEEPINTENT)
4 4 50.16.55.145 14618 (AMAZON-AES)
24 26 3.33.220.150 16509 (AMAZON-02)
21 28 142.250.176.194 15169 (GOOGLE)
5 6 151.101.130.49 54113 (FASTLY)
2 3 2606:4700::68... 13335 (CLOUDFLAR...)
4 2620:1ec:c11:... 8068 (MICROSOFT...)
7 12 162.248.18.32 62713 (AS-PUBMATIC)
19 19 199.127.204.142 26120 (RHYTHMONE)
5 5 2620:112:f002... 6336 (TURN-US-ASN)
1 1 67.202.105.23 32748 (STEADFAST)
4 4 35.214.175.237 15169 (GOOGLE)
1 23.36.204.23 16625 (AKAMAI-AS)
7 7 63.251.28.234 13789 (INTERNAP-...)
5 6 3.225.218.10 14618 (AMAZON-AES)
2 2 69.166.1.12 27630 (AS-XFERNET)
1 174.137.133.32 27257 (WEBAIR-IN...)
1 8.2.111.13 46636 (NATCOWEB)
7 8 74.121.140.211 30419 (MEDIAMATH...)
8 74.119.119.139 19750 (AS-CRITEO)
2 2 104.102.111.7 16625 (AKAMAI-AS)
1 51.222.39.184 16276 (OVH)
2 2 124.146.215.48 2514 (INFOSPHER...)
2 80.77.87.161 46636 (NATCOWEB)
8 8 185.184.8.90 204995 (RTB-HOUSE...)
14 17 69.173.151.100 26667 (RUBICONPR...)
11 11 54.145.44.246 14618 (AMAZON-AES)
1 34.96.105.8 396982 (GOOGLE-CL...)
3 3 35.207.24.140 15169 (GOOGLE)
3 8 8.28.7.81 62713 (AS-PUBMATIC)
1 2607:f8b0:400... 15169 (GOOGLE)
3 8 35.169.137.149 14618 (AMAZON-AES)
2 2 108.138.106.60 16509 (AMAZON-02)
4 4 199.38.167.130 54312 (ROCKETFUEL)
4 8 35.190.60.146 15169 (GOOGLE)
1 1 2620:112:f002... 6336 (TURN-US-ASN)
3 3 74.119.119.150 19750 (AS-CRITEO)
2 2 35.210.53.219 19527 (GOOGLE-2)
1 2600:1f18:ed:... 14618 (AMAZON-AES)
8 2607:f8b0:400... 15169 (GOOGLE)
1 23.44.133.31 20940 (AKAMAI-ASN1)
9 52.45.73.233 14618 (AMAZON-AES)
1 2 44.209.151.219 14618 (AMAZON-AES)
8 33 8.28.7.83 62713 (AS-PUBMATIC)
2 2 35.236.220.17 396982 (GOOGLE-CL...)
2 67.220.228.202 16509 (AMAZON-02)
9 52.85.61.47 16509 (AMAZON-02)
15 23.54.68.184 16625 (AKAMAI-AS)
6 151.101.1.108 54113 (FASTLY)
22 68.67.161.182 29990 (ASN-APPNEX)
2 2 52.29.104.196 16509 (AMAZON-02)
1 1 35.208.249.213 15169 (GOOGLE)
11 33 23.105.14.106 30633 (LEASEWEB-...)
2 3 50.57.31.206 19994 (RACKSPACE)
1 82.145.213.8 39832 (NO-OPERA)
4 4 207.198.113.86 13768 (COGECO-PEER1)
1 2a04:4e42::300 54113 (FASTLY)
1 141.226.224.32 200478 (TABOOLA-AS)
8 2606:4700:20:... 13335 (CLOUDFLAR...)
2 54.84.64.172 14618 (AMAZON-AES)
8 37.157.6.254 198622 (ADFORM)
8 23.105.12.145 30633 (LEASEWEB-...)
2 85 104.22.68.131 13335 (CLOUDFLAR...)
4 162.248.18.34 62713 (AS-PUBMATIC)
2 4 107.178.244.119 15169 (GOOGLE)
2 108.138.106.40 16509 (AMAZON-02)
4 34.95.69.49 396982 (GOOGLE-CL...)
2 52.45.162.216 14618 (AMAZON-AES)
1 52.205.175.196 14618 (AMAZON-AES)
1 34.246.81.142 16509 (AMAZON-02)
1 1 204.2.226.29 2914 (NTT-LTD-2914)
1 1 198.24.170.28 19437 (SS-ASH)
2 142.250.65.230 15169 (GOOGLE)
8 104.69.48.172 16625 (AKAMAI-AS)
9 2607:f8b0:402... 15169 (GOOGLE)
12 2607:f8b0:400... 15169 (GOOGLE)
12 108.139.47.67 16509 (AMAZON-02)
4 172.217.13.98 15169 (GOOGLE)
2 2600:1400:900... 20940 (AKAMAI-ASN1)
4 13.85.16.224 8075 (MICROSOFT...)
2 34.117.228.201 396982 (GOOGLE-CL...)
2 52.116.53.150 36351 (SOFTLAYER)
1 1 52.204.92.248 14618 (AMAZON-AES)
2 2 195.244.31.10 63140 (IGUANA-WO...)
1 1 51.255.68.171 16276 (OVH)
2 2 72.251.229.176 32475 (SINGLEHOP...)
2 2 52.71.141.42 14618 (AMAZON-AES)
1 1 69.90.254.78 13768 (COGECO-PEER1)
1 1 34.102.163.6 396982 (GOOGLE-CL...)
1 1 172.105.221.29 63949 (AKAMAI-LI...)
1 35.186.193.173 15169 (GOOGLE)
1 1 20.85.134.6 8075 (MICROSOFT...)
1 162.55.120.196 24940 (HETZNER-AS)
1 195.5.165.20 44968 (IPROM-AS)
2 2 184.27.80.19 16625 (AKAMAI-AS)
2 2 107.178.254.65 15169 (GOOGLE)
1 1 34.98.67.3 396982 (GOOGLE-CL...)
1 34.203.16.231 14618 (AMAZON-AES)
6 7 185.167.164.49 198622 (ADFORM)
1 1 34.102.253.54 396982 (GOOGLE-CL...)
1 1 188.166.17.21 14061 (DIGITALOC...)
8 9 167.235.114.248 24940 (HETZNER-AS)
4 4 23.105.12.137 30633 (LEASEWEB-...)
7 7 96.46.183.20 7979 (SERVERS-COM)
1 15.235.42.103 16276 (OVH)
10 10 8.2.108.194 46636 (NATCOWEB)
8 8 37.157.6.233 198622 (ADFORM)
1 52.85.61.83 16509 (AMAZON-02)
3 3 35.171.239.119 14618 (AMAZON-AES)
3 34.196.240.226 14618 (AMAZON-AES)
2 40.71.13.169 8075 (MICROSOFT...)
2 2 3.234.11.15 14618 (AMAZON-AES)
7 2a03:2880:f11... 32934 (FACEBOOK)
1 2 54.205.176.242 14618 (AMAZON-AES)
5 7 3.221.8.21 14618 (AMAZON-AES)
1 13.225.214.90 16509 (AMAZON-02)
4 4 141.94.171.213 16276 (OVH)
2 2 96.17.64.208 16625 (AKAMAI-AS)
18 2606:4700:10:... 13335 (CLOUDFLAR...)
1 1 35.190.90.30 15169 (GOOGLE)
2 2 52.72.252.60 14618 (AMAZON-AES)
1 1 54.156.165.4 14618 (AMAZON-AES)
1 1 34.111.151.213 396982 (GOOGLE-CL...)
1 142.251.35.162 15169 (GOOGLE)
994 178
27    192.0.66.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
www.mercurynews.com
2    13.33.60.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-60-24.ewr52.r.cloudfront.net
htlbid.com
3    2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
5    2607:f8b0:4020:807::200a (Montreal, Canada)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2607:f8b0:4006:81c::200a (Flushing, United States)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
4    2607:f8b0:4006:80a::200a (Flushing, United States)

ASN15169 (GOOGLE, US)
maps.googleapis.com
1    2600:9000:2511:fc00:10:474e:104a:2961 (United States)

ASN16509 (AMAZON-02, US)
cdn.auth0.com
3    2607:f8b0:4020:805::200d (Montreal, Canada)

ASN15169 (GOOGLE, US)
accounts.google.com
1    143.204.146.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-146-37.ewr52.r.cloudfront.net
cdn.p-n.io
16    18.164.96.113 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-96-113.jfk50.r.cloudfront.net
a869.mercurynews.com
3    2600:9000:2510:2e00:3:b7e:8940:93a1 (United States)

ASN16509 (AMAZON-02, US)
cmp.osano.com
1    20.60.62.4 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
prodmg2.blob.core.windows.net
2    13.225.214.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-63.ewr50.r.cloudfront.net
tags.remixd.com
1    18.164.101.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-101-60.jfk50.r.cloudfront.net
cdn.parsely.com
1    2600:9000:21dd:7800:8:2ae1:d740:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.viafoura.net
18    2607:f8b0:4006:81c::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net
2    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
2    2606:2800:11f:17a5:191a:18d5:537:22f9 (United States)

ASN15133 (EDGECAST, US)
az416426.vo.msecnd.net
1    2a04:4e42:600::282 (United States)

ASN54113 (FASTLY, US)
polyfill.io
4    52.40.223.220 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-40-223-220.us-west-2.compute.amazonaws.com
session.mercurynews.com
3    52.200.130.143 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-200-130-143.compute-1.amazonaws.com
digitalfirstmedia.blueconic.net
2    2606:4700::6810:7caf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
42    151.101.193.44 (United States)

ASN54113 (FASTLY, US)
cdn.taboola.com
pm-widget.taboola.com
trc.taboola.com
vidstat.taboola.com
images.taboola.com
imprnjmp.taboola.com
match.taboola.com
5    2607:f8b0:4006:80f::2008 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
8    2607:f8b0:4020:804::2003 (Montreal, Canada)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    54.144.144.142 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-144-144-142.compute-1.amazonaws.com
p1.parsely.com
4    35.190.38.143 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 143.38.190.35.bc.googleusercontent.com
pubcast-files.remixd.com
player-files.remixd.com
3    108.138.107.138 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-107-138.jfk50.r.cloudfront.net
c.amazon-adsystem.com
8    2606:2800:11f:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)
loader-cdn.azureedge.net
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
cdn.czx5eyk0exbhwp43ya.biz
cdn.pranmcpkx.com
1    2600:1f18:44f0:4850:e869:190e:35cd:331e (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
api.viafoura.co
3    192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org
s.w.org
2    137.184.240.117 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
www.foo.software
5    2620:116:800b:21:b08a:1dc5:659b:4055 (United States)

ASN14618 (AMAZON-AES, US)
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
4    207.198.113.205 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel.sitescout.com
2    2606:4700:4400::ac40:99f6 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.confiant-integrations.net
1    13.35.93.23 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-23.jfk50.r.cloudfront.net
launchpad-wrapper.privacymanager.io
6    13.35.93.31 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-31.jfk50.r.cloudfront.net
sb.scorecardresearch.com
1    52.55.146.213 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-55-146-213.compute-1.amazonaws.com
i.viafoura.co
1    2600:9000:21dd:a600:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
1    104.18.25.185 (None, )

ASN13335 (CLOUDFLARENET, US)
htlb.casalemedia.com
1    54.164.26.28 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-164-26-28.compute-1.amazonaws.com
tlx.3lift.com
6    44.207.246.26 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-207-246-26.compute-1.amazonaws.com
ads.yieldmo.com
9    2620:100:a001::18 (United States)

ASN19750 (AS-CRITEO, US)
bidder.criteo.com
31    68.67.179.113 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
8    2602:803:c002:200::116 (United States)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
9    104.36.115.111 (United States)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
1    18.164.98.157 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-98-157.jfk50.r.cloudfront.net
aax.amazon-adsystem.com
1    2606:4700:10::ac43:266a (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.id5-sync.com
1    2600:9000:2511:6e00:a:e047:753:be1 (United States)

ASN16509 (AMAZON-02, US)
cdn.prod.uidapi.com
11    2620:100:a001::4 (United States)

ASN19750 (AS-CRITEO, US)
static.criteo.net
18    2620:100:a001::c (United States)

ASN19750 (AS-CRITEO, US)
gum.criteo.com
12    2607:f8b0:4020:807::200e (Montreal, Canada)

ASN15169 (GOOGLE, US)
www.google-analytics.com
3    3.215.224.52 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-215-224-52.compute-1.amazonaws.com
dpm.demdex.net
8    34.111.113.62 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com
pixel.tapad.com
3    50.16.197.56 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-197-56.compute-1.amazonaws.com
loadm.exelator.com
loada.exelator.com
1    2a02:6ea0:c400::11 (New York, United States)

ASN60068 (CDN77 ^_^, GB)
load77.exelator.com
1    23.200.197.46 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-200-197-46.deploy.static.akamaitechnologies.com
sync.teads.tv
5    23.20.148.40 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-20-148-40.compute-1.amazonaws.com
sync.crwdcntrl.net
bcp.crwdcntrl.net
1    23.37.104.225 (Englewood, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-104-225.deploy.static.akamaitechnologies.com
s.btstatic.com
2    107.178.250.234 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 234.250.178.107.bc.googleusercontent.com
js.matheranalytics.com
2    18.164.116.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-116-119.jfk50.r.cloudfront.net
consent.api.osano.com
1    23.54.69.53 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-54-69-53.deploy.static.akamaitechnologies.com
s.ntv.io
2    2600:9000:23cb:9a00:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)
b-code.liadm.com
1    2600:9000:2209:4400:1:a3fa:7cc0:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.jwplayer.com
2    34.228.182.143 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-228-182-143.compute-1.amazonaws.com
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev
10    141.95.98.64 (France)

ASN16276 (OVH, FR)
PTR: ns3216658.ip-141-95-98.eu
id5-sync.com
19    2607:f8b0:4020:806::2002 (Montreal, Canada)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
pagead2.googlesyndication.com
1    18.164.116.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-116-116.jfk50.r.cloudfront.net
launchpad.privacymanager.io
1    104.26.5.15 (None, )

ASN13335 (CLOUDFLARENET, US)
api-mg2.db-ip.com
1    52.217.193.97 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
paywall-ad-bucket.s3.amazonaws.com
24    52.46.128.147 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
4    2a03:2880:f012:8:face:b00c:0:1 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    52.217.228.1 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
ams-pageview-public.s3.amazonaws.com
5    54.162.81.74 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-81-74.compute-1.amazonaws.com
www.i.matheranalytics.com
4    3.228.62.117 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-228-62-117.compute-1.amazonaws.com
jadserve.postrelease.com
1    3.14.222.105 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-14-222-105.us-east-2.compute.amazonaws.com
s.thebrighttag.com
1    2600:1f18:730:b120:94f1:b451:8dad:7124 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
rp.liadm.com
1    3.227.221.232 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-221-232.compute-1.amazonaws.com
rp4.liadm.com
7    2607:f8b0:4006:816::2004 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.google.com
4    2607:f8b0:4020:807::2003 (Montreal, Canada)

ASN15169 (GOOGLE, US)
www.google.ca
1    23.215.40.23 (McAllen, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-215-40-23.deploy.static.akamaitechnologies.com
cs.media.net
2    2600:9000:2209:5400:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)
s.ad.smaato.net
2    52.85.61.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-61.ewr53.r.cloudfront.net
geo.privacymanager.io
19    141.226.224.48 (United States)

ASN200478 (TABOOLA-AS, IL)
us-trc-events.taboola.com
us-match.taboola.com
us-vid-events.taboola.com
sync.taboola.com
sync-t1.taboola.com
2    3.234.8.191 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-234-8-191.compute-1.amazonaws.com
rtb.gumgum.com
27    192.40.39.223 (Canada)

ASN27381 (CASALE-MEDIA, CA)
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
r.casalemedia.com
ssum.casalemedia.com
3    23.105.14.100 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
PTR: 23.105.14.100.rdns.racklot.com
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
8    2606:ae80:1471:16::730 (United States)

ASN25751 (VALUECLICK, US)
amazon-tam-match.dotomi.com
casale-match.dotomi.com
pulsepoint-match.dotomi.com
pubmatic-match.dotomi.com
17    3.223.221.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-221-83.compute-1.amazonaws.com
match.sharethrough.com
11    23.54.68.197 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-54-68-197.deploy.static.akamaitechnologies.com
ads.pubmatic.com
1    54.208.104.226 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-208-104-226.compute-1.amazonaws.com
sync-amz.ads.yieldmo.com
18    104.91.103.236 (Boston, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-91-103-236.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
7    198.148.27.140 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
1    23.33.238.169 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-33-238-169.deploy.static.akamaitechnologies.com
sli.mercurynews.com
2    54.210.26.99 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-210-26-99.compute-1.amazonaws.com
crb.kargo.com
7    63.251.86.49 (United States)

ASN32475 (SINGLEHOP-LLC, US)
ap.lijit.com
7    63.251.86.50 (United States)

ASN10913 (INTERNAP-BLK, US)
ce.lijit.com
11    3.227.148.228 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-148-228.compute-1.amazonaws.com
cs-server-s2s.yellowblue.io
cs.yellowblue.io
6    35.71.139.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com
eb2.3lift.com
5    2607:f8b0:4006:816::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
adservice.google.com
11    2607:f8b0:4006:821::2001 (Flushing, United States)

ASN15169 (GOOGLE, US)
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com
7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
8    68.67.160.26 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
secure.adnxs.com
19    3.214.33.241 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-214-33-241.compute-1.amazonaws.com
usersync.gumgum.com
29    35.211.178.172 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 172.178.211.35.bc.googleusercontent.com
x.bidswitch.net
3    34.204.237.207 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-204-237-207.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
3    54.163.224.69 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-163-224-69.compute-1.amazonaws.com
sync.srv.stackadapt.com
8    64.202.112.191 (Chicago, United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
6    23.192.32.8 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-192-32-8.deploy.static.akamaitechnologies.com
stags.bluekai.com
x.dlx.addthis.com
4    70.42.32.63 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com
sync.outbrain.com
16    35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com
us-u.openx.net
u.openx.net
eu-u.openx.net
9    2600:1f18:4e9:5a07:b5c0:eead:85e9:361a (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
pr-bh.ybp.yahoo.com
2    50.16.251.137 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-251-137.compute-1.amazonaws.com
sync.ipredictive.com
2    2603:c020:400d:3000:f50:982a:7877:65bd (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
2    169.197.150.8 (United States)

ASN398989 (DEEPINTENT, US)
PTR: g.deepintent.com
match.deepintent.com
4    50.16.55.145 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-55-145.compute-1.amazonaws.com
ad.360yield.com
ice.360yield.com
26    3.33.220.150 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com
match.adsrvr.org
insight.adsrvr.org
28    142.250.176.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f2.1e100.net
cm.g.doubleclick.net
6    151.101.130.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
3    2606:4700::6812:18ad (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
4    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
12    162.248.18.32 (United States)

ASN62713 (AS-PUBMATIC, US)
image8.pubmatic.com
19    199.127.204.142 (United States)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
5    2620:112:f002:bbbb::21 (United States)

ASN6336 (TURN-US-ASN, US)
ad.turn.com
1    67.202.105.23 (Palos Park, United States)

ASN32748 (STEADFAST, US)
PTR: ip23.67-202-105.static.steadfastdns.net
ssc-cms.33across.com
4    35.214.175.237 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 237.175.214.35.bc.googleusercontent.com
csync.loopme.me
1    23.36.204.23 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-36-204-23.deploy.static.akamaitechnologies.com
contextual.media.net
7    63.251.28.234 (United States)

ASN13789 (INTERNAP-BLK3, US)
ads.stickyadstv.com
6    3.225.218.10 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-218-10.compute-1.amazonaws.com
ups.analytics.yahoo.com
2    69.166.1.12 (United States)

ASN27630 (AS-XFERNET, US)
sync.go.sonobi.com
1    174.137.133.32 (United States)

ASN27257 (WEBAIR-INTERNET, US)
sync.adkernel.com
1    8.2.111.13 (United States)

ASN46636 (NATCOWEB, US)
cs.iqzone.com
8    74.121.140.211 (Reston, United States)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
8    74.119.119.139 (United States)

ASN19750 (AS-CRITEO, US)
mug.criteo.com
2    104.102.111.7 (Billerica, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-102-111-7.deploy.static.akamaitechnologies.com
secure-assets.rubiconproject.com
1    51.222.39.184 (Canada)

ASN16276 (OVH, FR)
PTR: ip184.ip-51-222-39.net
onetag-sys.com
2    124.146.215.48 (Japan)

ASN2514 (INFOSPHERE NTT PC Communications, Inc., JP)
tg.socdm.com
2    80.77.87.161 (Clifton, United States)

ASN46636 (NATCOWEB, US)
cs.admanmedia.com
8    185.184.8.90 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net
creativecdn.com
17    69.173.151.100 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
token.rubiconproject.com
11    54.145.44.246 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-145-44-246.compute-1.amazonaws.com
match.prod.bidr.io
1    34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com
tr.blismedia.com
3    35.207.24.140 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com
rtb.mfadsrvr.com
8    8.28.7.81 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
1    2607:f8b0:4004:c0b::9a (Ashburn, United States)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
8    35.169.137.149 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-169-137-149.compute-1.amazonaws.com
i.liadm.com
2    108.138.106.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-60.jfk50.r.cloudfront.net
live.rezync.com
4    199.38.167.130 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
8    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
idsync.rlcdn.com
id.rlcdn.com
1    2620:112:f002:bbbb::23 (United States)

ASN6336 (TURN-US-ASN, US)
d.turn.com
3    74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)
dis.criteo.com
2    35.210.53.219 (Brussels, Belgium)

ASN19527 (GOOGLE-2, US)
PTR: 219.53.210.35.bc.googleusercontent.com
pool.admedo.com
1    2600:1f18:ed:550e:ae88:c386:1391:2528 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
i6.liadm.com
8    2607:f8b0:4006:824::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.googletagservices.com
1    23.44.133.31 (Piscataway, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-44-133-31.deploy.static.akamaitechnologies.com
js.moatads.com
9    52.45.73.233 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-73-233.compute-1.amazonaws.com
protected-by.clarium.io
2    44.209.151.219 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-209-151-219.compute-1.amazonaws.com
thrtle.com
33    8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
simage2.pubmatic.com
2    35.236.220.17 (Washington, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 17.220.236.35.bc.googleusercontent.com
um.simpli.fi
2    67.220.228.202 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
9    52.85.61.47 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-47.ewr53.r.cloudfront.net
sopalk.com
15    23.54.68.184 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-54-68-184.deploy.static.akamaitechnologies.com
acdn.adnxs.com
acdn.adnxs-simple.com
crcdn01.adnxs-simple.com
6    151.101.1.108 (United States)

ASN54113 (FASTLY, US)
cdn.adnxs.com
22    68.67.161.182 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
nym1-ib.adnxs.com
2    52.29.104.196 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-104-196.eu-central-1.compute.amazonaws.com
ih.adscale.de
1    35.208.249.213 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 213.249.208.35.bc.googleusercontent.com
trace.mediago.io
33    23.105.14.106 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
PTR: 23.105.14.106.rdns.racklot.com
rtb-csync.smartadserver.com
3    50.57.31.206 (United States)

ASN19994 (RACKSPACE, US)
uipglob.semasio.net
1    82.145.213.8 (Norway)

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology
t.adx.opera.com
4    207.198.113.86 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
1    2a04:4e42::300 (United States)

ASN54113 (FASTLY, US)
pips.taboola.com
1    141.226.224.32 (United States)

ASN200478 (TABOOLA-AS, IL)
cds.taboola.com
8    2606:4700:20::681a:a19 (United States)

ASN13335 (CLOUDFLARENET, US)
hb.adpone.com
2    54.84.64.172 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-84-64-172.compute-1.amazonaws.com
k.p-n.io
8    37.157.6.254 (Denmark)

ASN198622 (ADFORM, DK)
adx.adform.net
8    23.105.12.145 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
prg.smartadserver.com
85    104.22.68.131 (None, )

ASN13335 (CLOUDFLARENET, US)
prebid.smilewanted.com
csync.smilewanted.com
static.smilewanted.com
4    162.248.18.34 (United States)

ASN62713 (AS-PUBMATIC, US)
simage4.pubmatic.com
image4.pubmatic.com
4    107.178.244.119 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 119.244.178.107.bc.googleusercontent.com
beacon.sojern.com
pixel.sojern.com
2    108.138.106.40 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-40.jfk50.r.cloudfront.net
choices.truste.com
4    34.95.69.49 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 49.69.95.34.bc.googleusercontent.com
i.clean.gg
2    52.45.162.216 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-162-216.compute-1.amazonaws.com
rtb.adentifi.com
1    52.205.175.196 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-175-196.compute-1.amazonaws.com
sync.bfmio.com
1    34.246.81.142 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-246-81-142.eu-west-1.compute.amazonaws.com
synchroscript.deliveryengine.adswizz.com
1    204.2.226.29 (United States)

ASN2914 (NTT-LTD-2914, US)
pmp.mxptint.net
1    198.24.170.28 (Ashburn, United States)

ASN19437 (SS-ASH, US)
server.cpmstar.com
2    142.250.65.230 (Staten Island, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f6.1e100.net
ad.doubleclick.net
8    104.69.48.172 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-69-48-172.deploy.static.akamaitechnologies.com
ssl.connextra.com
9    2607:f8b0:4020:805::2006 (Montreal, Canada)

ASN15169 (GOOGLE, US)
s0.2mdn.net
12    2607:f8b0:4006:809::2001 (Flushing, United States)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
12    108.139.47.67 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-47-67.jfk50.r.cloudfront.net
choices.trustarc.com
4    172.217.13.98 (United States)

ASN15169 (GOOGLE, US)
PTR: yul02s04-in-f2.1e100.net
googleads4.g.doubleclick.net
2    2600:1400:9000::6875:b641 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)
cdn.doubleverify.com
4    13.85.16.224 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
prod-dfm-proxy-connext.azurewebsites.net
2    34.117.228.201 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 201.228.117.34.bc.googleusercontent.com
tps.doubleverify.com
tpsc-ue1.doubleverify.com
2    52.116.53.150 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 96.35.7434.ip4.static.sl-reverse.com
8proof.com
1    52.204.92.248 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-92-248.compute-1.amazonaws.com
rtb.adstanding.com
2    195.244.31.10 (Newark, United States)

ASN63140 (IGUANA-WORLDWIDE, US)
visitor.omnitagjs.com
1    51.255.68.171 (France)

ASN16276 (OVH, FR)
PTR: ns3028611.ip-51-255-68.eu
dsp.nrich.ai
2    72.251.229.176 (United States)

ASN32475 (SINGLEHOP-LLC, US)
cm.adgrx.com
2    52.71.141.42 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-71-141-42.compute-1.amazonaws.com
pm.w55c.net
1    69.90.254.78 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
ums.acuityplatform.com
1    34.102.163.6 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 6.163.102.34.bc.googleusercontent.com
ad.mrtnsvr.com
1    172.105.221.29 (Tokyo, Japan)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1875-29.members.linode.com
gocm.c.appier.net
1    35.186.193.173 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com
ipac.ctnsnet.com
1    20.85.134.6 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
mweb.ck.inmobi.com
1    162.55.120.196 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.196.120.55.162.clients.your-server.de
matching.truffle.bid
1    195.5.165.20 (Slovenia)

ASN44968 (IPROM-AS, SI)
core.iprom.net
2    184.27.80.19 (Englewood, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-27-80-19.deploy.static.akamaitechnologies.com
px.owneriq.net
2    107.178.254.65 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com
1    34.98.67.3 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 3.67.98.34.bc.googleusercontent.com
tags.rd.linksynergy.com
1    34.203.16.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-203-16-231.compute-1.amazonaws.com
bpi.rtactivate.com
7    185.167.164.49 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
dmp.adform.net
1    34.102.253.54 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 54.253.102.34.bc.googleusercontent.com
ads.playground.xyz
1    188.166.17.21 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
match.adsby.bidtheatre.com
9    167.235.114.248 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.248.114.235.167.clients.your-server.de
sync.richaudience.com
4    23.105.12.137 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
sync.smartadserver.com
7    96.46.183.20 (United States)

ASN7979 (SERVERS-COM, US)
ads.betweendigital.com
1    15.235.42.103 (Victoria, Canada)

ASN16276 (OVH, FR)
PTR: haproxy-ca-002.roqad.pl
wt.rqtrk.eu
10    8.2.108.194 (United States)

ASN46636 (NATCOWEB, US)
us.ck-ie.com
8    37.157.6.233 (Denmark)

ASN198622 (ADFORM, DK)
cm.adform.net
1    52.85.61.83 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-83.ewr53.r.cloudfront.net
cdn.callrail.com
3    35.171.239.119 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-239-119.compute-1.amazonaws.com
usermatch.krxd.net
3    34.196.240.226 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-240-226.compute-1.amazonaws.com
beacon.krxd.net
2    40.71.13.169 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com
2    3.234.11.15 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-234-11-15.compute-1.amazonaws.com
ads.creative-serving.com
7    2a03:2880:f112:83:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)
www.facebook.com
2    54.205.176.242 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-176-242.compute-1.amazonaws.com
io.narrative.io
7    3.221.8.21 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-221-8-21.compute-1.amazonaws.com
a.audrte.com
1    13.225.214.90 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-90.ewr50.r.cloudfront.net
aa.agkn.com
4    141.94.171.213 (France)

ASN16276 (OVH, FR)
PTR: pikafka-eu-5.cloudy.ovh
pixel.onaudience.com
2    96.17.64.208 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a96-17-64-208.deploy.static.akamaitechnologies.com
tags.bluekai.com
18    2606:4700:10::6816:36ce (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.connectad.io
sync-eu.connectad.io
sync.connectad.io
1    35.190.90.30 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 30.90.190.35.bc.googleusercontent.com
odr.mookie1.com
2    52.72.252.60 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-252-60.compute-1.amazonaws.com
ads.avct.cloud
1    54.156.165.4 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-156-165-4.compute-1.amazonaws.com
sonata-notifications.taptapnetworks.com
1    34.111.151.213 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 213.151.111.34.bc.googleusercontent.com
dmp.brand-display.com
1    142.251.35.162 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f2.1e100.net
ade.googlesyndication.com
Apex Domain
Subdomains		 Transfer
85 smilewanted.com
prebid.smilewanted.com — Cisco Umbrella Rank: 6641
csync.smilewanted.com — Cisco Umbrella Rank: 3226
static.smilewanted.com — Cisco Umbrella Rank: 12179
118 KB
79 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 249
secure.adnxs.com — Cisco Umbrella Rank: 476
acdn.adnxs.com — Cisco Umbrella Rank: 611
cdn.adnxs.com — Cisco Umbrella Rank: 1701
nym1-ib.adnxs.com — Cisco Umbrella Rank: 1056
471 KB
77 pubmatic.com
hbopenbid.pubmatic.com — Cisco Umbrella Rank: 564
ads.pubmatic.com — Cisco Umbrella Rank: 547
image8.pubmatic.com — Cisco Umbrella Rank: 737
image6.pubmatic.com — Cisco Umbrella Rank: 822
image2.pubmatic.com — Cisco Umbrella Rank: 1020
simage2.pubmatic.com — Cisco Umbrella Rank: 761
simage4.pubmatic.com — Cisco Umbrella Rank: 1351
image4.pubmatic.com — Cisco Umbrella Rank: 1216
97 KB
63 taboola.com
cdn.taboola.com — Cisco Umbrella Rank: 949
pm-widget.taboola.com — Cisco Umbrella Rank: 4879
trc.taboola.com — Cisco Umbrella Rank: 650
vidstat.taboola.com — Cisco Umbrella Rank: 2894
us-trc-events.taboola.com — Cisco Umbrella Rank: 6282
images.taboola.com — Cisco Umbrella Rank: 2011
imprnjmp.taboola.com — Cisco Umbrella Rank: 7873
us-match.taboola.com — Cisco Umbrella Rank: 7985
us-vid-events.taboola.com — Cisco Umbrella Rank: 7434
sync.taboola.com — Cisco Umbrella Rank: 1088
sync-t1.taboola.com — Cisco Umbrella Rank: 1302
match.taboola.com — Cisco Umbrella Rank: 5554
pips.taboola.com — Cisco Umbrella Rank: 1621
cds.taboola.com — Cisco Umbrella Rank: 1928
4 MB
56 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 219
googleads.g.doubleclick.net — Cisco Umbrella Rank: 57
cm.g.doubleclick.net — Cisco Umbrella Rank: 244
stats.g.doubleclick.net — Cisco Umbrella Rank: 124
ad.doubleclick.net — Cisco Umbrella Rank: 184
googleads4.g.doubleclick.net — Cisco Umbrella Rank: 359
507 KB
48 smartadserver.com
ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 8210
ssbsync.smartadserver.com — Cisco Umbrella Rank: 867
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 615
prg.smartadserver.com — Cisco Umbrella Rank: 1488
sync.smartadserver.com — Cisco Umbrella Rank: 1588
34 KB
48 mercurynews.com
www.mercurynews.com — Cisco Umbrella Rank: 65849
a869.mercurynews.com — Cisco Umbrella Rank: 191725
session.mercurynews.com — Cisco Umbrella Rank: 236852
sli.mercurynews.com — Cisco Umbrella Rank: 281843
790 KB
45 rubiconproject.com
fastlane.rubiconproject.com — Cisco Umbrella Rank: 543 Failed
eus.rubiconproject.com — Cisco Umbrella Rank: 639
secure-assets.rubiconproject.com — Cisco Umbrella Rank: 1134
pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 1178
pixel.rubiconproject.com — Cisco Umbrella Rank: 381
token.rubiconproject.com — Cisco Umbrella Rank: 656
118 KB
40 googlesyndication.com
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 133
tpc.googlesyndication.com — Cisco Umbrella Rank: 155
7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
ade.googlesyndication.com — Cisco Umbrella Rank: 321
201 KB
38 criteo.com
bidder.criteo.com — Cisco Umbrella Rank: 742
gum.criteo.com — Cisco Umbrella Rank: 407
mug.criteo.com — Cisco Umbrella Rank: 2114
dis.criteo.com — Cisco Umbrella Rank: 601
61 KB
30 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 357
aax.amazon-adsystem.com — Cisco Umbrella Rank: 444
s.amazon-adsystem.com — Cisco Umbrella Rank: 337
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1032
82 KB
29 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 361
13 KB
28 casalemedia.com
htlb.casalemedia.com — Cisco Umbrella Rank: 626
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 486
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 621
dsum.casalemedia.com — Cisco Umbrella Rank: 1634
r.casalemedia.com — Cisco Umbrella Rank: 1485
ssum.casalemedia.com — Cisco Umbrella Rank: 1386
23 KB
26 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 375
insight.adsrvr.org — Cisco Umbrella Rank: 592
15 KB
23 adform.net
adx.adform.net — Cisco Umbrella Rank: 4222
c1.adform.net — Cisco Umbrella Rank: 635
cm.adform.net — Cisco Umbrella Rank: 1254
dmp.adform.net — Cisco Umbrella Rank: 3522
9 KB
21 gumgum.com
rtb.gumgum.com — Cisco Umbrella Rank: 1673
usersync.gumgum.com — Cisco Umbrella Rank: 2018
7 KB
18 connectad.io
cdn.connectad.io — Cisco Umbrella Rank: 5633
sync-eu.connectad.io — Cisco Umbrella Rank: 4301
sync.connectad.io — Cisco Umbrella Rank: 5442
7 KB
17 sharethrough.com
match.sharethrough.com — Cisco Umbrella Rank: 572
10 KB
16 openx.net
us-u.openx.net — Cisco Umbrella Rank: 492
u.openx.net — Cisco Umbrella Rank: 740
eu-u.openx.net — Cisco Umbrella Rank: 2623
2 KB
15 yahoo.com
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 468
ups.analytics.yahoo.com — Cisco Umbrella Rank: 340
7 KB
15 google.com
accounts.google.com — Cisco Umbrella Rank: 59
www.google.com — Cisco Umbrella Rank: 3
adservice.google.com — Cisco Umbrella Rank: 107
79 KB
14 lijit.com
ap.lijit.com — Cisco Umbrella Rank: 772
ce.lijit.com — Cisco Umbrella Rank: 1036
11 KB
13 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 618
9 KB
13 liadm.com
b-code.liadm.com — Cisco Umbrella Rank: 2948
rp.liadm.com — Cisco Umbrella Rank: 2277
rp4.liadm.com — Cisco Umbrella Rank: 8165
i.liadm.com — Cisco Umbrella Rank: 671
i6.liadm.com — Cisco Umbrella Rank: 2341
26 KB
12 trustarc.com
choices.trustarc.com — Cisco Umbrella Rank: 918
47 KB
12 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 60
42 KB
11 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 602
5 KB
11 yellowblue.io
cs-server-s2s.yellowblue.io — Cisco Umbrella Rank: 3980
cs.yellowblue.io — Cisco Umbrella Rank: 3215
6 KB
11 criteo.net
static.criteo.net — Cisco Umbrella Rank: 583
305 KB
11 id5-sync.com
cdn.id5-sync.com — Cisco Umbrella Rank: 839
id5-sync.com — Cisco Umbrella Rank: 434
36 KB
10 ck-ie.com
us.ck-ie.com — Cisco Umbrella Rank: 3354
5 KB
10 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 80
ajax.googleapis.com — Cisco Umbrella Rank: 422
maps.googleapis.com — Cisco Umbrella Rank: 388
210 KB
9 richaudience.com
sync.richaudience.com — Cisco Umbrella Rank: 2090
2 KB
9 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 338
195 KB
9 sopalk.com
sopalk.com — Cisco Umbrella Rank: 63099
38 KB
9 clarium.io
protected-by.clarium.io — Cisco Umbrella Rank: 1555
2 KB
8 connextra.com
ssl.connextra.com — Cisco Umbrella Rank: 10712
77 KB
8 adpone.com
hb.adpone.com — Cisco Umbrella Rank: 22776
977 KB
8 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 207
277 KB
8 rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 426
id.rlcdn.com — Cisco Umbrella Rank: 751
1 KB
8 creativecdn.com
creativecdn.com — Cisco Umbrella Rank: 498
2 KB
8 mathtag.com
sync.mathtag.com — Cisco Umbrella Rank: 566
4 KB
8 zemanta.com
b1sync.zemanta.com — Cisco Umbrella Rank: 560
5 KB
8 dotomi.com
amazon-tam-match.dotomi.com — Cisco Umbrella Rank: 5746
casale-match.dotomi.com — Cisco Umbrella Rank: 3996
pulsepoint-match.dotomi.com — Cisco Umbrella Rank: 8602
pubmatic-match.dotomi.com — Cisco Umbrella Rank: 4315
3 KB
8 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 513
2 KB
8 sitescout.com
pixel.sitescout.com — Cisco Umbrella Rank: 3944
pixel-sync.sitescout.com — Cisco Umbrella Rank: 756
6 KB
8 gstatic.com
fonts.gstatic.com
192 KB
7 audrte.com
a.audrte.com — Cisco Umbrella Rank: 2906
4 KB
7 facebook.com
www.facebook.com — Cisco Umbrella Rank: 101
349 B
7 betweendigital.com
ads.betweendigital.com — Cisco Umbrella Rank: 1846
4 KB
7 stickyadstv.com
ads.stickyadstv.com — Cisco Umbrella Rank: 617
3 KB
7 contextweb.com
bh.contextweb.com — Cisco Umbrella Rank: 648
7 KB
7 matheranalytics.com
js.matheranalytics.com — Cisco Umbrella Rank: 11816
www.i.matheranalytics.com — Cisco Umbrella Rank: 11436
45 KB
7 yieldmo.com
ads.yieldmo.com — Cisco Umbrella Rank: 689
sync-amz.ads.yieldmo.com — Cisco Umbrella Rank: 6466
4 KB
7 3lift.com
tlx.3lift.com — Cisco Umbrella Rank: 638
eb2.3lift.com — Cisco Umbrella Rank: 421
3 KB
6 krxd.net
usermatch.krxd.net — Cisco Umbrella Rank: 1650
beacon.krxd.net — Cisco Umbrella Rank: 637
2 KB
6 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1281
3 KB
6 turn.com
ad.turn.com — Cisco Umbrella Rank: 1039
d.turn.com — Cisco Umbrella Rank: 1463
3 KB
6 everesttech.net
sync-tm.everesttech.net — Cisco Umbrella Rank: 778
1 KB
6 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 589
tags.bluekai.com — Cisco Umbrella Rank: 653
2 KB
6 scorecardresearch.com
sb.scorecardresearch.com — Cisco Umbrella Rank: 160
4 KB
6 remixd.com
tags.remixd.com — Cisco Umbrella Rank: 23147
pubcast-files.remixd.com — Cisco Umbrella Rank: 24886
player-files.remixd.com — Cisco Umbrella Rank: 23769
49 KB
5 crwdcntrl.net
sync.crwdcntrl.net — Cisco Umbrella Rank: 948
bcp.crwdcntrl.net — Cisco Umbrella Rank: 952
2 KB
5 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 1215
pixel.quantserve.com — Cisco Umbrella Rank: 977
cms.quantserve.com — Cisco Umbrella Rank: 846
11 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 82
396 KB
5 osano.com
cmp.osano.com — Cisco Umbrella Rank: 6025
consent.api.osano.com — Cisco Umbrella Rank: 11374
82 KB
4 onaudience.com
pixel.onaudience.com — Cisco Umbrella Rank: 3499
2 KB
4 azurewebsites.net
prod-dfm-proxy-connext.azurewebsites.net — Cisco Umbrella Rank: 75189
2 KB
4 doubleverify.com
cdn.doubleverify.com — Cisco Umbrella Rank: 490
tps.doubleverify.com — Cisco Umbrella Rank: 516
tpsc-ue1.doubleverify.com — Cisco Umbrella Rank: 1435
107 KB
4 clean.gg
i.clean.gg — Cisco Umbrella Rank: 1363
119 B
4 sojern.com
beacon.sojern.com — Cisco Umbrella Rank: 4829
pixel.sojern.com — Cisco Umbrella Rank: 7038
698 B
4 rfihub.com
p.rfihub.com — Cisco Umbrella Rank: 933
3 KB
4 loopme.me
csync.loopme.me — Cisco Umbrella Rank: 1024
975 B
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 389
25 KB
4 360yield.com
ad.360yield.com — Cisco Umbrella Rank: 662
ice.360yield.com — Cisco Umbrella Rank: 2409
1 KB
4 outbrain.com
sync.outbrain.com — Cisco Umbrella Rank: 763
1 KB
4 google.ca
www.google.ca — Cisco Umbrella Rank: 7757
690 B
4 postrelease.com
jadserve.postrelease.com — Cisco Umbrella Rank: 1322
4 KB
4 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 176
329 KB
4 exelator.com
loadm.exelator.com — Cisco Umbrella Rank: 1685
load77.exelator.com — Cisco Umbrella Rank: 4389
loada.exelator.com — Cisco Umbrella Rank: 26108
3 KB
4 privacymanager.io
launchpad-wrapper.privacymanager.io — Cisco Umbrella Rank: 4219
launchpad.privacymanager.io — Cisco Umbrella Rank: 3796
geo.privacymanager.io — Cisco Umbrella Rank: 2038
11 KB
3 adnxs-simple.com
acdn.adnxs-simple.com — Cisco Umbrella Rank: 2129
crcdn01.adnxs-simple.com — Cisco Umbrella Rank: 4451
133 KB
3 semasio.net
uipglob.semasio.net — Cisco Umbrella Rank: 1332
2 KB
3 mfadsrvr.com
rtb.mfadsrvr.com — Cisco Umbrella Rank: 1160
1022 B
3 tribalfusion.com
a.tribalfusion.com — Cisco Umbrella Rank: 920
s.tribalfusion.com — Cisco Umbrella Rank: 2022
1 KB
3 stackadapt.com
sync.srv.stackadapt.com — Cisco Umbrella Rank: 792
1 KB
3 cognitivlabs.com
beacon.lynx.cognitivlabs.com — Cisco Umbrella Rank: 1669
1 KB
3 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 218
3 KB
3 czx5eyk0exbhwp43ya.biz
cdn.czx5eyk0exbhwp43ya.biz — Cisco Umbrella Rank: 40869
781 KB
3 w.org
s.w.org — Cisco Umbrella Rank: 2154
4 KB
3 azureedge.net
loader-cdn.azureedge.net — Cisco Umbrella Rank: 28989
fp-cdn.azureedge.net — Cisco Umbrella Rank: 54391
g2insights-cdn.azureedge.net — Cisco Umbrella Rank: 52545
73 KB
3 blueconic.net
digitalfirstmedia.blueconic.net — Cisco Umbrella Rank: 107748
2 KB
3 p-n.io
cdn.p-n.io — Cisco Umbrella Rank: 4894
k.p-n.io — Cisco Umbrella Rank: 3105
58 KB
3 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 379
98 KB
2 avct.cloud
ads.avct.cloud — Cisco Umbrella Rank: 4619
1 KB
2 narrative.io
io.narrative.io — Cisco Umbrella Rank: 5330
643 B
2 creative-serving.com
ads.creative-serving.com — Cisco Umbrella Rank: 4938
1 KB
2 visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 687
306 B
2 pippio.com
pippio.com — Cisco Umbrella Rank: 852
880 B
2 owneriq.net
px.owneriq.net — Cisco Umbrella Rank: 1856
1 KB
2 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 1012
1 KB
2 adgrx.com
cm.adgrx.com — Cisco Umbrella Rank: 1615
1011 B
2 omnitagjs.com
visitor.omnitagjs.com — Cisco Umbrella Rank: 962
618 B
2 8proof.com
8proof.com — Cisco Umbrella Rank: 38306
cdn.8proof.com Failed
3 KB
2 adentifi.com
rtb.adentifi.com — Cisco Umbrella Rank: 1337
2 truste.com
choices.truste.com — Cisco Umbrella Rank: 932
11 KB
2 adscale.de
ih.adscale.de — Cisco Umbrella Rank: 2994
633 B
2 simpli.fi
um.simpli.fi — Cisco Umbrella Rank: 976
1 KB
2 thrtle.com
thrtle.com — Cisco Umbrella Rank: 1466
686 B
2 addthis.com
x.dlx.addthis.com — Cisco Umbrella Rank: 1561
1 KB
2 admedo.com
pool.admedo.com — Cisco Umbrella Rank: 6081
753 B
2 rezync.com
live.rezync.com — Cisco Umbrella Rank: 1583
1 KB
2 admanmedia.com
cs.admanmedia.com — Cisco Umbrella Rank: 1103
199 B
2 socdm.com
tg.socdm.com — Cisco Umbrella Rank: 1091
2 KB
2 sonobi.com
sync.go.sonobi.com — Cisco Umbrella Rank: 1089
1 KB
2 deepintent.com
match.deepintent.com — Cisco Umbrella Rank: 1163
594 B
2 technoratimedia.com
sync.technoratimedia.com — Cisco Umbrella Rank: 1587
4 KB
2 ipredictive.com
sync.ipredictive.com — Cisco Umbrella Rank: 1069
1019 B
2 kargo.com
crb.kargo.com — Cisco Umbrella Rank: 1801
939 B
2 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 805
1 KB
2 media.net
cs.media.net — Cisco Umbrella Rank: 1628
contextual.media.net — Cisco Umbrella Rank: 645
1 KB
2 amazonaws.com
paywall-ad-bucket.s3.amazonaws.com — Cisco Umbrella Rank: 40997
ams-pageview-public.s3.amazonaws.com — Cisco Umbrella Rank: 13587
1 KB
2 pranmcpkx.com
cdn.pranmcpkx.com — Cisco Umbrella Rank: 29707
5 KB
2 amazon.dev
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev — Cisco Umbrella Rank: 3905
456 B
2 confiant-integrations.net
cdn.confiant-integrations.net — Cisco Umbrella Rank: 1546
101 KB
2 foo.software
www.foo.software — Cisco Umbrella Rank: 68920
191 B
2 viafoura.co
api.viafoura.co — Cisco Umbrella Rank: 11496
i.viafoura.co — Cisco Umbrella Rank: 11514
3 KB
2 unpkg.com
unpkg.com — Cisco Umbrella Rank: 1035
3 KB
2 msecnd.net
az416426.vo.msecnd.net — Cisco Umbrella Rank: 2417
45 KB
2 wp.com
stats.wp.com — Cisco Umbrella Rank: 3092
pixel.wp.com — Cisco Umbrella Rank: 2850
5 KB
2 parsely.com
cdn.parsely.com — Cisco Umbrella Rank: 3107
p1.parsely.com — Cisco Umbrella Rank: 2311
21 KB
2 htlbid.com
htlbid.com — Cisco Umbrella Rank: 11396
110 KB
1 brand-display.com
dmp.brand-display.com — Cisco Umbrella Rank: 1867
366 B
1 taptapnetworks.com
sonata-notifications.taptapnetworks.com — Cisco Umbrella Rank: 7183
344 B
1 mookie1.com
odr.mookie1.com — Cisco Umbrella Rank: 1233
640 B
1 agkn.com
aa.agkn.com — Cisco Umbrella Rank: 533
654 B
1 callrail.com
cdn.callrail.com — Cisco Umbrella Rank: 8395
37 KB
1 rqtrk.eu
wt.rqtrk.eu — Cisco Umbrella Rank: 1647
350 B
1 bidtheatre.com
match.adsby.bidtheatre.com — Cisco Umbrella Rank: 2846
555 B
1 playground.xyz
ads.playground.xyz — Cisco Umbrella Rank: 4922
461 B
1 rtactivate.com
bpi.rtactivate.com — Cisco Umbrella Rank: 1881
109 B
1 linksynergy.com
tags.rd.linksynergy.com — Cisco Umbrella Rank: 4739
392 B
1 iprom.net
core.iprom.net — Cisco Umbrella Rank: 7132
279 B
1 truffle.bid
matching.truffle.bid — Cisco Umbrella Rank: 8501
1 inmobi.com
mweb.ck.inmobi.com — Cisco Umbrella Rank: 4691
348 B
1 ctnsnet.com
ipac.ctnsnet.com — Cisco Umbrella Rank: 6665
369 B
1 appier.net
gocm.c.appier.net — Cisco Umbrella Rank: 2634
436 B
1 mrtnsvr.com
ad.mrtnsvr.com — Cisco Umbrella Rank: 3053
308 B
1 acuityplatform.com
ums.acuityplatform.com — Cisco Umbrella Rank: 1501
674 B
1 nrich.ai
dsp.nrich.ai — Cisco Umbrella Rank: 3589
571 B
1 adstanding.com
rtb.adstanding.com — Cisco Umbrella Rank: 12158
361 B
1 cpmstar.com
server.cpmstar.com — Cisco Umbrella Rank: 3975
633 B
1 mxptint.net
pmp.mxptint.net — Cisco Umbrella Rank: 6777
701 B
1 adswizz.com
synchroscript.deliveryengine.adswizz.com — Cisco Umbrella Rank: 3020
397 B
1 bfmio.com
sync.bfmio.com — Cisco Umbrella Rank: 1630
425 B
1 opera.com
t.adx.opera.com — Cisco Umbrella Rank: 3272
467 B
1 mediago.io
trace.mediago.io — Cisco Umbrella Rank: 1105
188 B
1 moatads.com
js.moatads.com — Cisco Umbrella Rank: 34305
442 B
1 blismedia.com
tr.blismedia.com — Cisco Umbrella Rank: 2376
172 B
1 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 874
815 B
1 iqzone.com
cs.iqzone.com — Cisco Umbrella Rank: 1868
175 B
1 adkernel.com
sync.adkernel.com — Cisco Umbrella Rank: 1375
192 B
1 33across.com
ssc-cms.33across.com — Cisco Umbrella Rank: 1154
503 B
1 thebrighttag.com
s.thebrighttag.com — Cisco Umbrella Rank: 2009
14 KB
1 db-ip.com
api-mg2.db-ip.com — Cisco Umbrella Rank: 25049
792 B
1 jwplayer.com
cdn.jwplayer.com — Cisco Umbrella Rank: 2864
41 KB
1 ntv.io
s.ntv.io — Cisco Umbrella Rank: 3801
157 KB
1 btstatic.com
s.btstatic.com — Cisco Umbrella Rank: 9849
13 KB
1 teads.tv
sync.teads.tv — Cisco Umbrella Rank: 1404
278 B
1 uidapi.com
cdn.prod.uidapi.com — Cisco Umbrella Rank: 1509
2 KB
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 1141
449 B
1 polyfill.io
polyfill.io — Cisco Umbrella Rank: 1711
669 B
1 viafoura.net
cdn.viafoura.net — Cisco Umbrella Rank: 10590
12 KB
1 windows.net
prodmg2.blob.core.windows.net — Cisco Umbrella Rank: 64719
144 KB
1 auth0.com
cdn.auth0.com — Cisco Umbrella Rank: 7635
38 KB
994 175
Domain Requested by
71 csync.smilewanted.com 2 redirects hb.adpone.com
csync.smilewanted.com
www.mercurynews.com
sync-eu.connectad.io
33 rtb-csync.smartadserver.com 11 redirects www.mercurynews.com
31 ib.adnxs.com 8 redirects htlbid.com
acdn.adnxs.com
hb.adpone.com
csync.smilewanted.com
29 x.bidswitch.net 29 redirects
28 cm.g.doubleclick.net 21 redirects rtb.gumgum.com
eus.rubiconproject.com
www.mercurynews.com
u.openx.net
27 www.mercurynews.com www.mercurynews.com
cmp.osano.com
24 s.amazon-adsystem.com 2 redirects cmp.osano.com
s.amazon-adsystem.com
rtb.gumgum.com
ssum-sec.casalemedia.com
bh.contextweb.com
match.sharethrough.com
sync-amz.ads.yieldmo.com
cs-server-s2s.yellowblue.io
ce.lijit.com
eus.rubiconproject.com
ads.pubmatic.com
u.openx.net
23 simage2.pubmatic.com 4 redirects s.amazon-adsystem.com
www.mercurynews.com
rtb.gumgum.com
ads.pubmatic.com
23 match.adsrvr.org 21 redirects u.openx.net
22 nym1-ib.adnxs.com www.mercurynews.com
cdn.adnxs.com
hb.adpone.com
acdn.adnxs-simple.com
sopalk.com
20 cdn.taboola.com cmp.osano.com
www.mercurynews.com
19 usersync.gumgum.com 1 redirects rtb.gumgum.com
eus.rubiconproject.com
ads.pubmatic.com
18 eus.rubiconproject.com s.amazon-adsystem.com
eus.rubiconproject.com
cs-server-s2s.yellowblue.io
rtb.gumgum.com
hb.adpone.com
www.mercurynews.com
18 gum.criteo.com 8 redirects cmp.osano.com
www.mercurynews.com
static.criteo.net
18 securepubads.g.doubleclick.net www.mercurynews.com
cmp.osano.com
securepubads.g.doubleclick.net
www.googletagservices.com
17 match.sharethrough.com 10 redirects s.amazon-adsystem.com
match.sharethrough.com
www.mercurynews.com
16 pagead2.googlesyndication.com ad.doubleclick.net
acdn.adnxs-simple.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.mercurynews.com
www.googletagservices.com
az416426.vo.msecnd.net
16 a869.mercurynews.com www.mercurynews.com
a869.mercurynews.com
cmp.osano.com
15 dsum-sec.casalemedia.com 1 redirects ssum-sec.casalemedia.com
ssum.casalemedia.com
13 sync.1rx.io 13 redirects
13 images.taboola.com www.mercurynews.com
12 sync.connectad.io sync-eu.connectad.io
ssum.casalemedia.com
u.openx.net
ads.pubmatic.com
12 choices.trustarc.com choices.truste.com
choices.trustarc.com
www.mercurynews.com
12 tpc.googlesyndication.com www.mercurynews.com
acdn.adnxs-simple.com
tpc.googlesyndication.com
7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
cmp.osano.com
12 acdn.adnxs.com www.mercurynews.com
sopalk.com
hb.adpone.com
12 image8.pubmatic.com 7 redirects sync-amz.ads.yieldmo.com
cs-server-s2s.yellowblue.io
ads.pubmatic.com
12 www.google-analytics.com cmp.osano.com
www.googletagmanager.com
az416426.vo.msecnd.net
www.google-analytics.com
www.mercurynews.com
11 pixel.rubiconproject.com 8 redirects eus.rubiconproject.com
11 match.prod.bidr.io 11 redirects
11 us-u.openx.net 5 redirects rtb.gumgum.com
u.openx.net
11 ads.pubmatic.com s.amazon-adsystem.com
rtb.gumgum.com
hb.adpone.com
www.mercurynews.com
sync-eu.connectad.io
11 static.criteo.net cmp.osano.com
az416426.vo.msecnd.net
www.mercurynews.com
hb.adpone.com
static.criteo.net
10 us.ck-ie.com 10 redirects
10 sync.taboola.com 2 redirects www.mercurynews.com
10 image2.pubmatic.com 4 redirects s.amazon-adsystem.com
ads.pubmatic.com
10 id5-sync.com 9 redirects cdn.id5-sync.com
9 sync.richaudience.com 8 redirects csync.smilewanted.com
9 s0.2mdn.net www.mercurynews.com
sopalk.com
s0.2mdn.net
9 sopalk.com www.mercurynews.com
sopalk.com
cmp.osano.com
9 protected-by.clarium.io www.mercurynews.com
9 pr-bh.ybp.yahoo.com 3 redirects rtb.gumgum.com
ssum.casalemedia.com
u.openx.net
9 79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com cmp.osano.com
9 hbopenbid.pubmatic.com htlbid.com
hb.adpone.com
9 bidder.criteo.com htlbid.com
hb.adpone.com
8 cm.adform.net 8 redirects
8 ssl.connextra.com sopalk.com
ssl.connextra.com
hb.adpone.com
8 prebid.smilewanted.com hb.adpone.com
8 prg.smartadserver.com hb.adpone.com
8 adx.adform.net hb.adpone.com
8 hb.adpone.com www.mercurynews.com
sopalk.com
8 www.googletagservices.com www.mercurynews.com
acdn.adnxs-simple.com
www.googletagservices.com
s0.2mdn.net
7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
8 i.liadm.com 3 redirects cmp.osano.com
i.liadm.com
8 image6.pubmatic.com 3 redirects ads.pubmatic.com
8 creativecdn.com 8 redirects
8 mug.criteo.com www.mercurynews.com
8 sync.mathtag.com 7 redirects i.liadm.com
8 b1sync.zemanta.com 8 redirects
8 secure.adnxs.com 5 redirects www.mercurynews.com
sopalk.com
8 pixel.tapad.com 3 redirects www.mercurynews.com
sync-amz.ads.yieldmo.com
s.amazon-adsystem.com
u.openx.net
8 fastlane.rubiconproject.com htlbid.com
hb.adpone.com
8 fonts.gstatic.com fonts.googleapis.com
7 a.audrte.com 5 redirects
7 www.facebook.com
7 ads.betweendigital.com 7 redirects
7 ads.stickyadstv.com 7 redirects
7 cs-server-s2s.yellowblue.io s.amazon-adsystem.com
cs-server-s2s.yellowblue.io
7 ce.lijit.com 1 redirects s.amazon-adsystem.com
ce.lijit.com
www.mercurynews.com
7 ap.lijit.com 7 redirects
7 bh.contextweb.com 3 redirects s.amazon-adsystem.com
bh.contextweb.com
www.mercurynews.com
7 www.google.com www.mercurynews.com
7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
cmp.osano.com
6 c1.adform.net 5 redirects ads.pubmatic.com
6 static.smilewanted.com csync.smilewanted.com
6 cdn.adnxs.com www.mercurynews.com
hb.adpone.com
6 idsync.rlcdn.com 3 redirects i.liadm.com
www.mercurynews.com
u.openx.net
6 ups.analytics.yahoo.com 5 redirects u.openx.net
6 sync.targeting.unrulymedia.com 6 redirects
6 sync-tm.everesttech.net 5 redirects ads.pubmatic.com
6 eb2.3lift.com 3 redirects s.amazon-adsystem.com
www.mercurynews.com
6 ads.yieldmo.com 1 redirects htlbid.com
sync-amz.ads.yieldmo.com
www.mercurynews.com
6 sb.scorecardresearch.com 2 redirects www.mercurynews.com
cmp.osano.com
5 ad.turn.com 5 redirects
5 dsum.casalemedia.com 1 redirects ssum-sec.casalemedia.com
ssum.casalemedia.com
5 adservice.google.com cmp.osano.com
www.mercurynews.com
5 www.i.matheranalytics.com www.mercurynews.com
5 www.googletagmanager.com cmp.osano.com
5 fonts.googleapis.com www.mercurynews.com
s0.2mdn.net
cmp.osano.com
4 sync-eu.connectad.io cdn.connectad.io
sync-eu.connectad.io
4 pixel.onaudience.com 4 redirects
4 sync.smartadserver.com 4 redirects
4 prod-dfm-proxy-connext.azurewebsites.net cdn.czx5eyk0exbhwp43ya.biz
4 googleads4.g.doubleclick.net acdn.adnxs-simple.com
www.mercurynews.com
4 i.clean.gg acdn.adnxs-simple.com
4 pixel-sync.sitescout.com 4 redirects
4 u.openx.net 1 redirects www.mercurynews.com
sync-eu.connectad.io
4 p.rfihub.com 4 redirects
4 cs.yellowblue.io cs-server-s2s.yellowblue.io
eus.rubiconproject.com
4 csync.loopme.me 4 redirects
4 bat.bing.com cmp.osano.com
4 sync.outbrain.com 3 redirects rtb.gumgum.com
4 stags.bluekai.com 4 redirects
4 ssum-sec.casalemedia.com 1 redirects s.amazon-adsystem.com
ssum-sec.casalemedia.com
rtb.gumgum.com
4 www.google.ca www.mercurynews.com
4 jadserve.postrelease.com cmp.osano.com
www.mercurynews.com
4 connect.facebook.net cmp.osano.com
4 trc.taboola.com cdn.taboola.com
az416426.vo.msecnd.net
www.mercurynews.com
4 sync.crwdcntrl.net 2 redirects www.mercurynews.com
4 pixel.sitescout.com 2 redirects www.mercurynews.com
4 session.mercurynews.com www.mercurynews.com
4 maps.googleapis.com www.mercurynews.com
maps.googleapis.com
cmp.osano.com
3 beacon.krxd.net
3 usermatch.krxd.net 3 redirects
3 insight.adsrvr.org 3 redirects
3 simage4.pubmatic.com ads.pubmatic.com
3 uipglob.semasio.net 2 redirects
3 sync-t1.taboola.com www.mercurynews.com
3 token.rubiconproject.com 3 redirects
3 dis.criteo.com 3 redirects
3 rtb.mfadsrvr.com 3 redirects
3 cms.quantserve.com 3 redirects
3 pixel-us-east.rubiconproject.com 3 redirects
3 sync.srv.stackadapt.com 3 redirects
3 beacon.lynx.cognitivlabs.com 2 redirects ads.pubmatic.com
3 us-trc-events.taboola.com www.mercurynews.com
3 player-files.remixd.com www.mercurynews.com
3 googleads.g.doubleclick.net cmp.osano.com
3 dpm.demdex.net 2 redirects www.mercurynews.com
3 cdn.czx5eyk0exbhwp43ya.biz cmp.osano.com
cdn.czx5eyk0exbhwp43ya.biz
3 s.w.org www.mercurynews.com
3 c.amazon-adsystem.com cmp.osano.com
c.amazon-adsystem.com
3 digitalfirstmedia.blueconic.net a869.mercurynews.com
cmp.osano.com
3 cmp.osano.com www.mercurynews.com
cmp.osano.com
3 accounts.google.com www.mercurynews.com
cmp.osano.com
accounts.google.com
3 cdn.jsdelivr.net www.mercurynews.com
cdn.jsdelivr.net
cmp.osano.com
2 ads.avct.cloud 2 redirects
2 ssum.casalemedia.com sync-eu.connectad.io
2 ice.360yield.com 2 redirects
2 cdn.connectad.io csync.smilewanted.com
2 id.rlcdn.com 1 redirects
2 tags.bluekai.com 2 redirects
2 io.narrative.io 1 redirects
2 ads.creative-serving.com 2 redirects
2 dc.services.visualstudio.com az416426.vo.msecnd.net
2 pippio.com 2 redirects
2 px.owneriq.net 2 redirects
2 pm.w55c.net 2 redirects
2 cm.adgrx.com 2 redirects
2 visitor.omnitagjs.com 2 redirects
2 8proof.com 7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
www.mercurynews.com
2 7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com www.mercurynews.com
2 pixel.sojern.com 2 redirects
2 cdn.doubleverify.com acdn.adnxs-simple.com
www.mercurynews.com
2 ad.doubleclick.net www.googletagservices.com
acdn.adnxs-simple.com
2 pubmatic-match.dotomi.com 2 redirects
2 rtb.adentifi.com ads.pubmatic.com
2 choices.truste.com hb.adpone.com
s0.2mdn.net
2 beacon.sojern.com hb.adpone.com
sopalk.com
2 acdn.adnxs-simple.com hb.adpone.com
2 k.p-n.io cdn.p-n.io
2 ih.adscale.de 2 redirects
2 aax-eu.amazon-adsystem.com eus.rubiconproject.com
www.mercurynews.com
2 um.simpli.fi 2 redirects
2 thrtle.com 1 redirects s.amazon-adsystem.com
2 us-match.taboola.com cmp.osano.com
2 x.dlx.addthis.com 1 redirects i.liadm.com
2 pool.admedo.com 2 redirects
2 live.rezync.com 2 redirects
2 cs.admanmedia.com rtb.gumgum.com
www.mercurynews.com
2 tg.socdm.com 2 redirects
2 secure-assets.rubiconproject.com 2 redirects
2 sync.go.sonobi.com 2 redirects
2 pulsepoint-match.dotomi.com 2 redirects
2 a.tribalfusion.com 1 redirects ads.pubmatic.com
2 casale-match.dotomi.com 2 redirects
2 ssbsync.smartadserver.com 1 redirects www.mercurynews.com
2 ad.360yield.com 2 redirects
2 match.deepintent.com 1 redirects rtb.gumgum.com
2 sync.technoratimedia.com 2 redirects
2 sync.ipredictive.com 2 redirects
2 crb.kargo.com s.amazon-adsystem.com
rtb.gumgum.com
2 amazon-tam-match.dotomi.com 2 redirects
2 rtb.gumgum.com 1 redirects s.amazon-adsystem.com
2 geo.privacymanager.io launchpad.privacymanager.io
2 s.ad.smaato.net 2 redirects
2 cdn.pranmcpkx.com cmp.osano.com
2 prod.us-east-1.cxm-bcn.publisher-services.amazon.dev c.amazon-adsystem.com
2 b-code.liadm.com cmp.osano.com
2 consent.api.osano.com cmp.osano.com
2 js.matheranalytics.com 1 redirects www.mercurynews.com
2 loadm.exelator.com 2 redirects
2 pm-widget.taboola.com cmp.osano.com
2 cdn.confiant-integrations.net cmp.osano.com
2 www.foo.software www.mercurynews.com
2 unpkg.com 1 redirects www.mercurynews.com
2 az416426.vo.msecnd.net www.mercurynews.com
cmp.osano.com
2 tags.remixd.com www.mercurynews.com
tags.remixd.com
2 htlbid.com www.mercurynews.com
1 ade.googlesyndication.com
1 dmp.brand-display.com 1 redirects
1 sonata-notifications.taptapnetworks.com 1 redirects
1 odr.mookie1.com 1 redirects
1 loada.exelator.com 1 redirects
1 aa.agkn.com
1 dmp.adform.net 1 redirects
1 cdn.callrail.com cmp.osano.com
1 tpsc-ue1.doubleverify.com cdn.doubleverify.com
1 wt.rqtrk.eu www.mercurynews.com
1 match.adsby.bidtheatre.com 1 redirects
1 ads.playground.xyz 1 redirects
1 bpi.rtactivate.com www.mercurynews.com
1 bcp.crwdcntrl.net www.mercurynews.com
1 tags.rd.linksynergy.com 1 redirects
1 core.iprom.net ads.pubmatic.com
1 matching.truffle.bid ads.pubmatic.com
1 mweb.ck.inmobi.com 1 redirects
1 ipac.ctnsnet.com ads.pubmatic.com
1 gocm.c.appier.net 1 redirects
1 ad.mrtnsvr.com 1 redirects
1 ums.acuityplatform.com 1 redirects
1 crcdn01.adnxs-simple.com hb.adpone.com
1 dsp.nrich.ai 1 redirects
1 rtb.adstanding.com 1 redirects
1 eu-u.openx.net 1 redirects
1 tps.doubleverify.com www.mercurynews.com
1 server.cpmstar.com 1 redirects
1 pmp.mxptint.net 1 redirects
1 synchroscript.deliveryengine.adswizz.com rtb.gumgum.com
1 sync.bfmio.com rtb.gumgum.com
1 image4.pubmatic.com www.mercurynews.com
1 r.casalemedia.com www.mercurynews.com
1 cds.taboola.com az416426.vo.msecnd.net
1 pips.taboola.com az416426.vo.msecnd.net
1 t.adx.opera.com www.mercurynews.com
1 match.taboola.com www.mercurynews.com
1 trace.mediago.io 1 redirects
1 us-vid-events.taboola.com www.mercurynews.com
1 imprnjmp.taboola.com cmp.osano.com
1 js.moatads.com www.mercurynews.com
1 i6.liadm.com i.liadm.com
1 d.turn.com 1 redirects
1 stats.g.doubleclick.net az416426.vo.msecnd.net
1 tr.blismedia.com ce.lijit.com
1 onetag-sys.com cs-server-s2s.yellowblue.io
1 cs.iqzone.com rtb.gumgum.com
1 sync.adkernel.com rtb.gumgum.com
1 contextual.media.net cs-server-s2s.yellowblue.io
1 ssc-cms.33across.com 1 redirects
1 s.tribalfusion.com 1 redirects
1 sli.mercurynews.com www.mercurynews.com
1 sync-amz.ads.yieldmo.com s.amazon-adsystem.com
1 ssbsync-us.smartadserver.com 1 redirects
1 vidstat.taboola.com cmp.osano.com
1 cs.media.net 1 redirects
1 rp4.liadm.com www.mercurynews.com
1 rp.liadm.com 1 redirects
1 s.thebrighttag.com cmp.osano.com
1 ams-pageview-public.s3.amazonaws.com www.mercurynews.com
1 pixel.quantserve.com www.mercurynews.com
1 paywall-ad-bucket.s3.amazonaws.com www.mercurynews.com
1 api-mg2.db-ip.com fp-cdn.azureedge.net
1 launchpad.privacymanager.io cmp.osano.com
1 cdn.jwplayer.com tags.remixd.com
1 s.ntv.io cmp.osano.com
1 s.btstatic.com cmp.osano.com
1 sync.teads.tv www.mercurynews.com
1 load77.exelator.com www.mercurynews.com
1 cdn.prod.uidapi.com cmp.osano.com
1 cdn.id5-sync.com cmp.osano.com
1 aax.amazon-adsystem.com c.amazon-adsystem.com
1 tlx.3lift.com htlbid.com
1 htlb.casalemedia.com htlbid.com
1 rules.quantcount.com cmp.osano.com
1 g2insights-cdn.azureedge.net cmp.osano.com
1 fp-cdn.azureedge.net cmp.osano.com
1 i.viafoura.co www.mercurynews.com
1 launchpad-wrapper.privacymanager.io cmp.osano.com
1 secure.quantserve.com cmp.osano.com
1 pixel.wp.com www.mercurynews.com
1 api.viafoura.co cdn.viafoura.net
1 loader-cdn.azureedge.net ajax.googleapis.com
1 pubcast-files.remixd.com tags.remixd.com
1 p1.parsely.com www.mercurynews.com
1 polyfill.io ajax.googleapis.com
1 stats.wp.com www.mercurynews.com
1 cdn.viafoura.net www.mercurynews.com
1 cdn.parsely.com www.mercurynews.com
1 prodmg2.blob.core.windows.net www.mercurynews.com
1 cdn.p-n.io www.mercurynews.com
1 cdn.auth0.com www.mercurynews.com
1 ajax.googleapis.com www.mercurynews.com
0 cdn.8proof.com Failed 8proof.com
994 290
Subject Issuer Validity Valid
mercurynews.com
R3		 2023-05-21 -
2023-08-19		 3 months crt.sh
htlbid.com
Amazon RSA 2048 M01		 2023-02-21 -
2023-11-19		 9 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-12-23 -
2024-01-24		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.auth0.com
Amazon RSA 2048 M01		 2023-02-24 -
2024-03-24		 a year crt.sh
accounts.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
pushlycdn.com
Amazon RSA 2048 M02		 2023-02-27 -
2024-02-13		 a year crt.sh
s762.pressenterprise.com
Amazon RSA 2048 M02		 2023-02-21 -
2023-11-02		 8 months crt.sh
cmp.osano.com
Amazon RSA 2048 M02		 2023-02-21 -
2023-09-30		 7 months crt.sh
*.blob.core.windows.net
Microsoft RSA TLS CA 01		 2023-03-20 -
2024-03-20		 a year crt.sh
*.remixd.com
Amazon RSA 2048 M02		 2023-02-09 -
2024-03-09		 a year crt.sh
*.parsely.com
Amazon RSA 2048 M02		 2023-05-06 -
2024-06-03		 a year crt.sh
viafoura.com
Amazon RSA 2048 M01		 2023-02-28 -
2023-10-06		 7 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA		 2022-11-14 -
2023-12-15		 a year crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2023-05-05 -
2024-04-28		 a year crt.sh
polyfill.io
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-12-10 -
2024-01-11		 a year crt.sh
*.mercurynews.com
Amazon RSA 2048 M01		 2023-03-30 -
2024-04-28		 a year crt.sh
*.blueconic.net
Amazon RSA 2048 M01		 2023-06-08 -
2024-07-06		 a year crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-12-08 -
2023-12-31		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
pubcast-files.remixd.com
GTS CA 1D4		 2023-05-25 -
2023-08-23		 3 months crt.sh
c.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-02-28 -
2024-02-17		 a year crt.sh
*.w.org
Sectigo ECC Domain Validation Secure Server CA		 2022-12-06 -
2024-01-06		 a year crt.sh
www.foo.software
Go Daddy Secure Certificate Authority - G2		 2022-12-29 -
2024-01-30		 a year crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-08-09 -
2023-09-09		 a year crt.sh
*.sitescout.com
GeoTrust Global TLS RSA4096 SHA256 2022 CA1		 2023-01-09 -
2024-02-02		 a year crt.sh
confiant-integrations.net
GTS CA 1P5		 2023-05-25 -
2023-08-23		 3 months crt.sh
*.privacymanager.io
Amazon RSA 2048 M02		 2023-02-22 -
2023-09-24		 7 months crt.sh
snibe7egl.wpc.edgecastcdn.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-03 -
2024-02-03		 a year crt.sh
quantserve.com
R3		 2023-06-13 -
2023-09-11		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-22 -
2024-05-21		 a year crt.sh
*.3lift.com
Amazon RSA 2048 M02		 2023-04-13 -
2024-05-11		 a year crt.sh
*.yieldmo.com
Amazon RSA 2048 M02		 2023-02-28 -
2023-10-12		 7 months crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-05-12 -
2023-08-10		 3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2023-02-13 -
2024-03-15		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-03-05 -
2024-04-03		 a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2022-06-13 -
2023-07-14		 a year crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-03-16 -
2024-03-08		 a year crt.sh
cdn.prod.uidapi.com
R3		 2023-05-18 -
2023-08-16		 3 months crt.sh
*.criteo.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-05-27 -
2023-08-27		 3 months crt.sh
teads.tv
R3		 2023-05-11 -
2023-08-09		 3 months crt.sh
s.btstatic.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-01-30 -
2024-02-20		 a year crt.sh
*.api.osano.com
Amazon RSA 2048 M01		 2023-02-24 -
2023-09-26		 7 months crt.sh
*.ntv.io
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-24 -
2023-10-26		 a year crt.sh
*.liadm.com
Amazon RSA 2048 M02		 2023-02-28 -
2024-01-30		 a year crt.sh
*.scorecardresearch.com
Sectigo RSA Domain Validation Secure Server CA		 2022-12-15 -
2023-12-28		 a year crt.sh
jwplayer.com
Amazon RSA 2048 M02		 2023-03-01 -
2023-12-25		 10 months crt.sh
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev
Amazon RSA 2048 M02		 2022-12-27 -
2024-01-25		 a year crt.sh
*.id5-sync.com
R3		 2023-04-18 -
2023-07-17		 3 months crt.sh
sni2bf2agl.wpc.edgecastcdn.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-31 -
2023-11-02		 a year crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01		 2023-03-21 -
2023-12-19		 9 months crt.sh
s.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-03-03 -
2024-02-19		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-03-30 -
2023-06-28		 3 months crt.sh
player-files.remixd.com
GTS CA 1D4		 2023-06-02 -
2023-08-31		 3 months crt.sh
www.i.matheranalytics.com
Amazon RSA 2048 M01		 2023-03-02 -
2024-01-13		 10 months crt.sh
*.postrelease.com
Amazon RSA 2048 M01		 2023-03-01 -
2023-12-25		 10 months crt.sh
signal.co
Entrust Certification Authority - L1K		 2023-02-10 -
2024-02-10		 a year crt.sh
www.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.google.ca
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
gumgum.com
Amazon RSA 2048 M02		 2023-06-07 -
2024-07-06		 a year crt.sh
casalemedia.com
Go Daddy Secure Certificate Authority - G2		 2022-12-13 -
2024-01-13		 a year crt.sh
*.sharethrough.com
Amazon RSA 2048 M01		 2023-06-14 -
2024-07-12		 a year crt.sh
*.ads.yieldmo.com
Amazon RSA 2048 M01		 2023-03-26 -
2024-04-23		 a year crt.sh
*.contextweb.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-04-10 -
2024-05-09		 a year crt.sh
sli.bayareanewsgroup.com
R3		 2023-04-14 -
2023-07-13		 3 months crt.sh
*.app.kargo.com
Amazon RSA 2048 M02		 2023-02-21 -
2024-01-18		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2023-05-06 -
2024-05-04		 a year crt.sh
*.yellowblue.io
Amazon ECDSA 256 M02		 2023-04-18 -
2024-05-16		 a year crt.sh
*.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2022-11-30 -
2024-01-01		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2023-02-16 -
2023-08-16		 6 months crt.sh
*.media.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-10 -
2024-02-18		 a year crt.sh
*.adkernel.com
AlphaSSL CA - SHA256 - G4		 2023-01-03 -
2024-02-04		 a year crt.sh
*.iqzone.com
Go Daddy Secure Certificate Authority - G2		 2023-04-05 -
2024-05-06		 a year crt.sh
*.ad-server.k8s.ggops.com
Amazon RSA 2048 M01		 2023-02-28 -
2024-02-09		 a year crt.sh
*.onetag-sys.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-12-28 -
2024-01-28		 a year crt.sh
*.admanmedia.com
Go Daddy Secure Certificate Authority - G2		 2023-04-20 -
2024-05-21		 a year crt.sh
tr.blismedia.com
GTS CA 1D4		 2023-06-09 -
2023-09-07		 3 months crt.sh
*.mathtag.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-03-30 -
2024-04-29		 a year crt.sh
a248.e.akamai.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-05-16 -
2024-05-15		 a year crt.sh
protected-by.clarium.io
Amazon RSA 2048 M01		 2022-12-16 -
2024-01-14		 a year crt.sh
*.everesttech.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-11-07 -
2023-12-09		 a year crt.sh
aax-eu.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-01-27 -
2024-01-27		 a year crt.sh
sopalk.com
Amazon RSA 2048 M01		 2023-02-24 -
2023-10-02		 7 months crt.sh
cdn.adnxs.com
GeoTrust RSA CA 2018		 2022-10-21 -
2023-10-22		 a year crt.sh
*.smartadserver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-01-21 -
2024-01-23		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2022-07-21 -
2023-08-21		 a year crt.sh
*.adx.opera.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-05-22 -
2024-06-20		 a year crt.sh
*.p-n.io
Amazon RSA 2048 M01		 2023-02-27 -
2024-01-21		 a year crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-20 -
2023-09-20		 a year crt.sh
*.sojern.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-17 -
2024-02-17		 a year crt.sh
*.truste.com
Amazon RSA 2048 M02		 2023-02-28 -
2024-01-16		 a year crt.sh
i.clean.gg
GTS CA 1D4		 2023-05-24 -
2023-08-22		 3 months crt.sh
adentifi.com
Amazon RSA 2048 M02		 2023-02-22 -
2023-09-03		 6 months crt.sh
*.bfmio.com
Amazon RSA 2048 M02		 2023-03-17 -
2024-04-14		 a year crt.sh
*.deliveryengine.adswizz.com
Amazon RSA 2048 M02		 2023-02-09 -
2024-02-13		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2023-04-04 -
2023-09-27		 6 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.connextra.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-03-28 -
2024-03-28		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.trustarc.com
Amazon RSA 2048 M02		 2023-04-17 -
2024-05-14		 a year crt.sh
*.doubleverify.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-05 -
2023-07-07		 a year crt.sh
*.azurewebsites.net
Microsoft Azure TLS Issuing CA 02		 2023-03-10 -
2024-03-04		 a year crt.sh
*.tps.doubleverify.com
Go Daddy Secure Certificate Authority - G2		 2022-09-28 -
2023-10-30		 a year crt.sh
*.8proof.com
Sectigo RSA Domain Validation Secure Server CA		 2023-01-29 -
2024-02-07		 a year crt.sh
beacon.lynx.cognitivlabs.com
Amazon RSA 2048 M02		 2023-03-31 -
2024-04-28		 a year crt.sh
*.ctnsnet.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-04 -
2023-11-06		 10 months crt.sh
truffle.bid
R3		 2023-05-24 -
2023-08-22		 3 months crt.sh
*.iprom.net
R3		 2023-05-23 -
2023-08-21		 3 months crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M01		 2022-11-07 -
2023-12-06		 a year crt.sh
*.tapad.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-14 -
2023-10-15		 a year crt.sh
rtactivate.com
Amazon RSA 2048 M01		 2023-03-14 -
2024-04-11		 a year crt.sh
*.richaudience.com
RapidSSL Global TLS RSA4096 SHA256 2022 CA1		 2023-02-27 -
2024-02-26		 a year crt.sh
swappy.callrail.com
Amazon RSA 2048 M01		 2023-03-02 -
2023-09-08		 6 months crt.sh
in.applicationinsights.azure.com
Microsoft Azure TLS Issuing CA 05		 2023-05-03 -
2024-04-27		 a year crt.sh
*.agkn.com
RapidSSL Global TLS RSA4096 SHA256 2022 CA1		 2022-09-06 -
2023-09-21		 a year crt.sh
*.semasio.net
GlobalSign GCC R3 DV TLS CA 2020		 2022-12-22 -
2024-01-23		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2023-02-02 -
2024-03-03		 a year crt.sh
connectad.io
Cloudflare Inc ECC CA-3		 2023-03-16 -
2024-03-15		 a year crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2023-02-21 -
2023-08-16		 6 months crt.sh

This page contains 235 frames:

Primary Page: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Frame ID: 4313964D8E9A2C411F435A835A750735
Requests: 304 HTTP requests in this frame

Frame: https://cmp.osano.com/
Frame ID: 57D2122A7DA9FF79C849C0D0302A9F48
Requests: 1 HTTP requests in this frame

Frame: https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Frame ID: EA47EC29BF1401CFAB55884683179DA9
Requests: 6 HTTP requests in this frame

Frame: https://cmp.osano.com/
Frame ID: 68B7FF8ADE217D62A67592F4F55460A4
Requests: 1 HTTP requests in this frame

Frame: https://cdn.jwplayer.com/libraries/FUtg69tL.js
Frame ID: 15592FF0CA32C151DB39328D076BC4D0
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Frame ID: CB09E5527C7AF27A4F7F41FC08FA560B
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Frame ID: 6C5DFDE0CAF32C99C7FC28B47C2F4B72
Requests: 3 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Frame ID: 2D82D72E6E2EEC9123DA17AA03C3E8A4
Requests: 15 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Frame ID: 63E9C5EB86BA4CA8E9910509AC83CE16
Requests: 10 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4614819635623485669&gdpr=0&gdpr_consent=
Frame ID: B93E50D8595CE1104589922F4C1F3CFD
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAB5mRHm00XWQN-vi56AAAAAAA&expiration=1687376643&is_secure=true&gdpr=0
Frame ID: 00B74DDA71D784EA01D27971D4ADBDC5
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Frame ID: A6A929DFB220D8BF9F5D4A2BF978652E
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Frame ID: 239016333C700649CC1D7C14A873309E
Requests: 12 HTTP requests in this frame

Frame: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Frame ID: E366BA83E256AB2F76AD05012CC81AB8
Requests: 7 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Frame ID: A5A6E8083E4B12EC31DBD4FB5EE5063C
Requests: 11 HTTP requests in this frame

Frame: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Frame ID: 77C08D59078F0E8F3CF7A023ABE454B2
Requests: 4 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=&us_privacy=1---
Frame ID: ABEEC83694C382EB245A6F6276FD5A39
Requests: 2 HTTP requests in this frame

Frame: https://crb.kargo.com/api/v1/dinitsync?partners=A9
Frame ID: A73206776EA4EF7A3556835A136B7FEA
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=1179662177681492769&ex=appnexus.com&gdpr=0
Frame ID: AB866549CD5CF95DBF8D5696B8CD1DF0
Requests: 1 HTTP requests in this frame

Frame: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Frame ID: B63054535D1F8A6CA00B708278AC1AAA
Requests: 7 HTTP requests in this frame

Frame: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Frame ID: 50EB49FBA41698EECE02F84F12F07083
Requests: 13 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3110826783617533917
Frame ID: 33C3AB2B3418E0AF181825EBCF4D8225
Requests: 1 HTTP requests in this frame

Frame: https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: AFB1F8B8C860A18951798352BA12FA7F
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=
Frame ID: 4703F8AA120AE3F57717069094143802
Requests: 1 HTTP requests in this frame

Frame: https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Frame ID: 02B8E6EE04DC32E352E6680035EFA4E5
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Frame ID: AD443165752431F0CDFA9BC073C94AD5
Requests: 11 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=ttd&i=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Frame ID: E58448FB4CBF7AAAE0C492379F3A61C6
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=mmh&i=c0d66492-0183-4f00-930f-e67415c7188d&gdpr=0&gdpr_consent=
Frame ID: F512CD8CB0D741CB96FDF816DFD2FFB2
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Frame ID: 66CE0E6FB95C4E5E5A6783F277BB9D51
Requests: 3 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=
Frame ID: 2FC7657BDA1C795EAFDBAFCE91393696
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=atm&i=ZJIBgwATV5hRfwBa&gdpr=0&gdpr_consent=
Frame ID: 4AD682FD6DE5859C5CB828FEE59A9E57
Requests: 1 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9hNGEyMmM2My0wMzQ5LTRjODYtOGFlOC05NWVjNmMzM2ZiMDk=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv
Frame ID: D95250E815FBF0F4D51C961338781384
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=sus&i=ZJIBg8Co8YQAAMZ2WjUAAAAA
Frame ID: 7932B5D128D3218D5C95C2D1100D003A
Requests: 1 HTTP requests in this frame

Frame: https://cs.admanmedia.com/sync/gumgum?puid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=&ccpa=
Frame ID: ABFAEED59EA567BF197E21972E5877F9
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Frame ID: 7A6DE7C4AA9D4D70FD79F03075066ECD
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=rth&i=2LK2FelB5bz5w6flSs8Z&pi=gumgum&tc=1
Frame ID: F9930D6A89E09E89E81A0D1EC1D014B3
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: BC82DD0FF93192423D606AA671BE5332
Requests: 3 HTTP requests in this frame

Frame: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Frame ID: FB79CA4055E0BA6D115DF11BA5EC4E72
Requests: 8 HTTP requests in this frame

Frame: https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 0F3FE8CC464473DD9AFAC1EE81446674
Requests: 4 HTTP requests in this frame

Frame: https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 2C97F1FF5B9715E74D7C311782DB3083
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvhiWDUF6eI08sd2ZS831sscFSfbD0BtGjLOFBu2kbqN0kk-5d-A_1fffaWK5PNZd3t9MR-aHHZveLb0z3vZ6KXCW5-xYYEXQR0OVgVWUVdQuzr2Km0ZiG2DaKh9bcSXfGuAh8VW3vJcNlZm-uCMVvYB9lvkEnTd4sNtUq7sP_XpWo0urQHcBG4Ay8P3V6x2Jf-yCHipU9zNmYTeYddv-MS8aAld54zrHWWeSDtXfhScTHbPNvRWzBuOLWpwbNkl0BSuOohbNvrUMApPMfKTR2ay6SUxHUf0hVrpYfdiCbDFNqh_tBtnN1qYcFj5XfzybEFsLs_LBkCuwE5qyIXSLKZLTkzwsdDWWaywV7Rt2eY_JtQ_sfOX3M6mXbfEoKx5DpX39TL&sai=AMfl-YS7ki03lVsmYpE6zumzI4_V5gk9jFZ9pODOZvXU6cu2KPMhjkgD-orM6dyzKDwynVX38jSe30HPJpoUnpYOdGmwwxEWaiEoF6AZHTycfrwZYtLVkFtE0JkvRi3PJg&sig=Cg0ArKJSzAaeTQEol8tPEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 2FEF873AE5B8C87714B9AE3A4A87EC37
Requests: 14 HTTP requests in this frame

Frame: https://imprnjmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8NMUCLAbgGQEK4mdf3xLAMwIUxM--vi0AAABgYID-AAl5fLONbTFyK3cTx1o0GtncCo9juRYuJw6XwznxeDyWISAhj2-2sS1GbuVu4liLRiObW-FxLNfC5cThcjgnHo_HMgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRA-mcjUJE3zXyIEjUUYAQAAAKjEyZQ9MkknqFhU-f__77cCcAUAIABRuyocNIvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjmIxcvoXNOXO4TA6PyTaZ2RwTi8NkWa4MM8dqeyRjf1xaaPRh-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3Ox2XhMa8XMsnGLFjbfWrhZLtcqy8w1srg2y5lhsxa9PqaLcWLcDRZbJBiwuBfJ0yKdKGcu32K5WplmvtXItZk5ZibHardZuZzL1WY4M0zEEs3JIp3ILvuOYTJy-RY258zhMjk8JttkZnNMLA6TZbkyzByrfcfkXGw2HtNaMbNs3KKFzbcWbpbLtcoyc40srs1yZtisRa-P6WKcGHeDxb4xG-4my8FktNg3ZsPdZDmYjBb7Dp3hu_qcjdLJUuzxaRfGcktncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrtgNVwkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrHHryAGw8lg_wBUiLVarW431mq1AA!&cmcv=&pix=undefined&cb=1687290244039&uv=134497419&tms=1687290244039&abt=nonrv_vA!ntvc_vB!tbt_unit!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=dc76c61d-97b1-44df-ac19-89baea9bccc2&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Frame ID: A601F32DF2F2FA7EE7BF728758A00D2C
Requests: 1 HTTP requests in this frame

Frame: https://us-match.taboola.com/sync?dast=V8NMUCLAbgGQEK4mdf3xLAMwIUxM--vi0AAABgYID-AAl5fLONbTFyK3cTx1o0GtncCo9juRYuJw6XwznxeDyWISAhj2-2sS1GbuVu4liLRiObW-FxLNfC5cThcjgnHo_HMgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRA-mcjUJE3zXyIEjUUYAQAAAKjEyZQ9MkknqFhU-f__77cCcAUAIABRuyocNIvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjmIxcvoXNOXO4TA6PyTaZ2RwTi8NkWa4MM8dqeyRjf1xaaPRh-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3Ox2XhMa8XMsnGLFjbfWrhZLtcqy8w1srg2y5lhsxa9PqaLcWLcDRZbJBiwuBfJ0yKdKGcu32K5WplmvtXItZk5ZibHardZuZzL1WY4M0zEEs3JIp3ILvuOYTJy-RY258zhMjk8JttkZnNMLA6TZbkyzByrfcfkXGw2HtNaMbNs3KKFzbcWbpbLtcoyc40srs1yZtisRa-P6WKcGHeDxb4xG-4my8FktNg3ZsPdZDmYjBb7Dp3hu_qcjdLJUuzxaRfGcktncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrtgNVwkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrHHryAGw8lg_wBUiLVarW431mq1AA!&excid=22&docw=0&cijs=1&nlb=false
Frame ID: 855507C93E9F0989B567FD3FE60D5498
Requests: 1 HTTP requests in this frame

Frame: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Frame ID: CC5A9545F4D4EF173C1289472FF0B8E8
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Frame ID: 9C7D6204FA0D4F2AF4676CBC41105D91
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1922&pub_id=2234281
Frame ID: FD87DE332AEDBD75FD7739F0BE5CE239
Requests: 2 HTTP requests in this frame

Frame: https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBg8Co8YQAAMZ2WjUAAAAA
Frame ID: 8809F4B2995203FA193342E92440DC89
Requests: 23 HTTP requests in this frame

Frame: https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 001AE63A1CC014D584B273F9E376691A
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 8DE5D930EEBD6499C7D1F5EE06B38DA9
Requests: 22 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=ytduubyrq&e=1069342552190
Frame ID: 6EC34AD11D2161EA9D83798C0F8259B5
Requests: 16 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=xkarpqq&e=1069342552190
Frame ID: 2CA47B65B7C67774E57462E78C94A032
Requests: 16 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=tcjtvkgl&e=1069342552190
Frame ID: F8A726EE5FF43C125B1DC7DF931F3960
Requests: 15 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=mpgdnr&e=1069342552190
Frame ID: 0E608E85FBBD4D592B5F3C06206EB6AF
Requests: 9 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=ayavvzdyv&e=1069342552190
Frame ID: D813086A9C77E571ECCCC96BCC59650C
Requests: 9 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=mahwikxa&e=1069342552190
Frame ID: 8D4DD7A592A03166276A613131926DE6
Requests: 15 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=wfeqdiirq&e=1069342552190
Frame ID: 9BD728CBFDA973C7CC82364298DA6CE2
Requests: 15 HTTP requests in this frame

Frame: https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 39DD1F1BD40A70FC5AC7B22A132A1F6C
Requests: 4 HTTP requests in this frame

Frame: https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 236C4DA6888F282FE9A3C0C29BDF8265
Requests: 4 HTTP requests in this frame

Frame: https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: C9FF6AE85CAC3D7C3F0136B38206EF3E
Requests: 4 HTTP requests in this frame

Frame: https://acdn.adnxs-simple.com/strikeforce/script.js
Frame ID: D3CDAE9507405523E3689D500CFE8B8B
Requests: 18 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: 88329EC7585157BBEFE2779B57E38A60
Requests: 29 HTTP requests in this frame

Frame: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Frame ID: 5AD9093BBE495E48A79C3CB24F55564A
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&redir=true&gdpr=0&gdpr_consent=
Frame ID: 7E2E3F1C694667DBE526147AE3040CE7
Requests: 1 HTTP requests in this frame

Frame: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Frame ID: 4759AB62361F12ACA27EFB4E421CF726
Requests: 1 HTTP requests in this frame

Frame: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Frame ID: 3ED28C29E9B911BDE6115E25BB5570E8
Requests: 1 HTTP requests in this frame

Frame: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Frame ID: 49CBE2EB65E006913C201013796B72DA
Requests: 1 HTTP requests in this frame

Frame: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Frame ID: 592D2FDF19E77DBD6CFF72B02C719512
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=pbm&i=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Frame ID: 46826FCEAA069A29BC6929AB4AB2569B
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs-simple.com/strikeforce/script.js
Frame ID: FE9164236A82247B8D7AD3AB974F2505
Requests: 7 HTTP requests in this frame

Frame: https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 343CA98B88FB135F917D9055AA4CA6FB
Requests: 4 HTTP requests in this frame

Frame: https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: C1F2D69C092077AFE1C155336468B214
Requests: 4 HTTP requests in this frame

Frame: https://ssl.connextra.com/CFL/selector/client?client=CFL&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&_cb=2031217352&apnauc=6968116950742194793&bidid=6968116950742194793&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?zhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8./cca=NzMyMCNOWU0yOjY0MzQ=/bn=86620/clickenc=
Frame ID: 033EEBBA5701DC627F457257C0D2D619
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 2135AC4D7EDAECDB19C6B89FDC4707FA
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: BC73351B3C3E55F5745B9147BC48DF04
Requests: 2 HTTP requests in this frame

Frame: https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=6968116950742194793&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FzhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjY0MzQ%3D%2Fbn%3D86620%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=6968116950742194793&_cb=2031217352
Frame ID: 7A0A53D1974EE816A5AF9D221132D388
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
Frame ID: 385F6BC42BAE0E590956988EC7F111A2
Requests: 9 HTTP requests in this frame

Frame: https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Frame ID: 086E700F79DA468ABCD58B3261994652
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: A93C0776EA63F6DBA2C438D68224BF55
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 028366EBD273F6E6994C202D2584A341
Requests: 3 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3941.js
Frame ID: D4EB0A302BB309038FFE57348653676A
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: AA3678E6EC2F80009FEDDED03DCEFE67
Requests: 3 HTTP requests in this frame

Frame: https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Frame ID: 146FC6F1B779D0476576AA09632407CD
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: F42AC0B9DFA2D2F09249F29F3FCB58E1
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 756C95C0B5E523C19F139DA44F41BDD4
Requests: 2 HTTP requests in this frame

Frame: https://8proof.com/app/rtbmarkup/5111?id=515456897218&ctd=110096&crid=1178&ap=ZJIBiAAKoMUKcQhIAAXjoCOFh5lBP83h-39-qg
Frame ID: 367C94855BC406184EEBCA768DFB3E97
Requests: 3 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: B9B434BA2951DD55FCE3B3F6D87D8B01
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: AC623BF021B6358EE7F61AB71A5A8293
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 2D0AF16B38897163E84D1FF8533E0CCE
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 415CAB706187B0C1E0D6861BE8D309E5
Requests: 10 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 1FF0518EE1520E9F838D4A95737E1CE0
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: BD084F91162476AED83E917B17F5DB41
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 0451E6931686DA28D8F78DEBE2CBC806
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 819253050192B580D2A8FBA0E4AE1577
Requests: 6 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 274F5E83AC1A16B48B85F1415439111C
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 2284AA5FEDF0BCC35078DE52D733CF52
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 0CBF8C2F4052A3B2ACE1DC74AEE644C9
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 7F5E4C5729A6E442656E368A6A5DF244
Requests: 5 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 8B374A6D6275D03601A943AA7253482B
Requests: 2 HTTP requests in this frame

Frame: https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKdDfBMnQYAAAMA1gAFAQiGg8ikBhC4js7X6Z24uA4YoZat_YGQwK8QKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlCH1L2uAVi5q5cBYABopq60AXjFxgWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaHVmKCdhJywgNDI1NDI5MCwgMCk7dWYoJ2kFFBg2MDgyMCwgDRQsZycsIDExNjI0MDIyFRUAYwEpGDA2MjAwMTcVFTByJywgMzY1OTE0NjMxBRbwi5ICvQQhZEcxU2Z3anhuNjhURUlmVXZhNEJHQUFndWF1WEFUQUVPQUJBQUVpUkNGRHUzOEVOV0FCZ2dRWm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUkNvQVFxd0FRQzVBVGVqeW1tVWxDY193UUUzbzhwcGxKUW5QOGtCQUFBQUFBQUEwRF9aQVFBCQ50UEFfNEFIVWg0UUM5UUZ2MDlvNW1BSUFvQUlCdFFJBSQAdg0I8JV3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01YQ0xLUndDd1FCaGdCTFVaUElEUXlCelkwTmpNek5ET2lBeE1Jd1lfQUxCQUtHQUV0QUFDQVBqSURkVzVydWdNSlRsbE5Nam8xTXpVMDRBUHBRNEFFNlpMa0E0Z0UwSlBrQTVBRUFaZ0VBY0VFQUEFoxRBQUFESkIBBw0BGDJBUUE4UVENDmBBQUFJZ0Y2aW1wQmRPa0ZIUjdTZTBfc1FVARoJATxNRUZBQUJBOFlOYVBUX0pCATscT0MtMGUwXzAuKAAITmtGCTHwQ0FBOERfZ0JSTHdCZGE4eFFYNEJkTFVnd0tDQmdOVlUwU0lCZ1NRQmdHWUJnQ2hCaC1GNjFHNEh2VV9xQVlFc2dZa0NREUoIQUFFAXANAQBHHQwASR0MNHVBWUuaApkBIUZ4VU1IPkECNExtcmx3RWdBQ2dBTVItFW1MT2dsT1dVMHlPalV6TlRSQTZVTkoNaBBBOEQ5UhEMDEFBQlodDABoHQwAcB0MAHgdDAw0QUlrNXTgOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL_ICEQoGQURWX0lEEgc0aXIc8gISCgZDUEcBFAAIcV4Y8gIKCgVDUAEUOAEw8gINCghBRFZfRlJFUREQHFJFTV9VU0VSBRAADAkgKENPREUSAPICMwoIAVEFD7gnTldVMVptTmhNell5TkdSbFpqTTBPRE01TURBd01EbGkuMWM4NDIz8gILCgdDUAk1HADyAhAKBUlPAYAEBzSJBgDyASEESU8VITgTCg9DVVNUT01fTU9ERUwBKxQA8gIaChYyFgAcTEVBRl9OQU0FmAgeCho2HQAIQVNUAT4QSUZJRUQBPhwNCghTUExJVAFN8JoBMIADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTc4qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjEwNDEjTllNMjo1MzU02gQCCAHgBAHwBIfUva4BiAUBmAUAoAX______wEFGAHABQDJBQAFARTwP9IFCQkFC3wAAADYBQHgBQHwBde3HvoFBAgAEACQBgCYBgC4BgDBBgEhMAAA8D_QBpgD2gYWChAJERkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAfFxgXSBw0JETMBMQjaBwYBaHAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=adbb459185429cc3e9681c6311cd9a291cb72323&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dxkarpqq%26e%3D1069342552190,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dxkarpqq%26e%3D1069342552190&
Frame ID: 1CC2DC793F511342035568F7560081AF
Requests: 6 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zF7KIcpbyyLXC8N1nw_eds0PliTXDJB1zQzLDEcp
Frame ID: 02AC891F193A3874DC805DDFDCB46248
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d47e24dc-0fa2-11ee-ac94-72b4b480830c
Frame ID: 71B82A2CF4B420EDA283E120EAFF06CA
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Frame ID: D08772D8D490BAF0610F0EF6A7EDBE21
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=cuj0HMYUXER6RDS6pY-AEJU4mbI&gdpr=0&gdpr_consent=
Frame ID: 481FA4A51D14F4A7C04B0FF0AFF9278D
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:NWVHfDIW1QbHgT5&gdpr=0&gdpr_consent=
Frame ID: 24BB9A50949DA0E3D127D4E2B7A47597
Requests: 1 HTTP requests in this frame

Frame: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Frame ID: 670B9AECD5CD32B9D0D85793369A594F
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501171541
Frame ID: 87689851290C9C2E786ABBCDB0E65BD8
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Frame ID: 6CAC843F6D8FED66656C108C57700E5F
Requests: 1 HTTP requests in this frame

Frame: https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: E777D2DC5FD0C8942D421367DA3F1284
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Frame ID: EE385F328F86F2382C7A12112FDE2324
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Frame ID: 6EB1A59CF8DF8716DB9143B37DFBF9D2
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=eTsnmm5VDg6trxz8jAGSZA
Frame ID: 2BFC82A2491894CEEABD9BA5375ECFD0
Requests: 1 HTTP requests in this frame

Frame: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Frame ID: 0615F8CAA884D9D96040192E33E5C456
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=a457c9e9-2914-4c4f-865e-b60bc0f898f7
Frame ID: 36A62E467D6B24E8AC913D07C4BEDED1
Requests: 1 HTTP requests in this frame

Frame: https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID
Frame ID: E07105E246541DF010B0351A84BF1150
Requests: 1 HTTP requests in this frame

Frame: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Frame ID: CFE4E2A59ECC7610EDF3516BAE5DD231
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766521439522184
Frame ID: 04FE9701FA7B395556B4A9991CF3B608
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:FCA67877EA764E1F821EE4EC1A0C959E&gdpr=0&gdpr_consent=
Frame ID: 73CFB8833BCF55131AAD5DB9ED8A323E
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 332AA6013ED9F5C56AC9891C6F2E516A
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Frame ID: D596F18F16D055712FB7DEB93FA8A373
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4614819635623485669
Frame ID: 93983B4AC811F7AD94025D99F250EAA1
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 129072AC4E86F7C42B74390E21A16BDD
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Frame ID: EB3E27F39D495EBC060D841DC2B02929
Requests: 1 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 667F36A9031B4F402017A0CEFF7CCF00
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: CE708D30248BE42EDA2FA29344441046
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Frame ID: E648ED05D1A3F324A241113294D33F23
Requests: 1 HTTP requests in this frame

Frame: https://ssl.connextra.com/CFL/selector/client?client=CFL&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&_cb=189151553&apnauc=1385579407814183431&bidid=1385579407814183431&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA./bcr=AAAAAAAA8D8=/cnd=%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8./cca=NzMyMCNOWU0yOjUzNDU=/bn=75718/clickenc=
Frame ID: 0F4433516BDE38D9A904271E646241EB
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 11EED0A8E760394CB4D2505861FE71EA
Requests: 2 HTTP requests in this frame

Frame: https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLrDPQXAWsGAAADANYABQEIhoPIpAYQh5Tx1pWkpJ0TGKGWrf2BkMCvECo2CdcbZmXxvJ4_EfVg_aBpN5c_GQAAAIDC9fA_IWVyeZLFFKE_KVq77UJznaY_MQAAACCF67E_MO7fwQ04mFBAmDlIAlDW563TAVi5q5cBYABopq60AXjGzwSAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNjAzODY4OCwgMCk7dWYoJ2knLCA3MzYxODkwLCAwKTt1ZignZycsIDE4Mjk2ODA0LCAwKTt1ZigncycsIDI3NTYxOTAwMCwgMCk7dWYoJ3InLCA0NDMyNDk2MjIFVfCLkgKhBCFBR19oYndqUXVMQVpFTmJucmRNQkdBQWd1YXVYQVRBQ09BQkFBRWlZT1ZEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRcW9BUXF3QVFDNUFTT3htZWZzbktZX3dRRWpzWm5uN0p5bVA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUhpcXNFRDlRRzhYYk05bUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DSXl5dmlJUUN4Z0NMUUFBQUFDNkF3bE9XVTB5T2pVek5EWGdBLWxEZ0FUZl80NExpQVRBOE5rSWtBUUJtQVFCd1EFNQkBCE1rRQkJAQEYRFlCQUR4QgELDQF4aUFYaEtaZ0Z1TG0yZ3dHcEJkT2tGSFI3U2UwX3NRVQUmHDB3emxQOEVGBQ0cTk1NMVRfSkIBYxxPQzFDdEVfMA0oBQEETmsJKCko8EBnQmNFaThBWGszOXdJLUFXZ3lmQUNnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkFrQQFIBQEAQh3HBEJrBRMFAQBDHRhETGdHQ2cuLpoCmQEhdlJieXRBOiUCZExtcmx3RWdBQ2dBTWR2NWZtcThkTzhfT2dsPV0UVkE2VU5KBV0FxQQ5UgEICQEEQloJCAEBBEJoAQYJAQRCcAkIAQEEQngBBgkBEEI0QUlrNXDgOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL_ICEQoGQURWX0lEEgc2aVcc8gISCgZDUEcBFAgIMThpQwEVCAVDUAEUFAkyNzU2MWFCOPICDQoIQURWX0ZSRVESAQkQHFJFTV9VU0VSBRAADAkgGENPREUSAPIBDwFZEQ8QCwoHQ1AVDhAQCgVJTwFhBAc3acwA8gEhBElPFSE4EwoPQ1VTVE9NX01PREVMASsUAPICGgoWMhYAHExFQUZfTkFNBXEIHgoaNh0ACEFTVAE-EElGSUVEAT4cFQoIU1BMSVQBTRnZ8IaAAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE3OKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NTM0NdoEAggB4AQB8ASlOiCIBQGYBQCgBf8RARgBwAUAyQUABQEU8D_SBQkJBQt8AAAA2AUB4AUB8AWiiQf6BQQIABAAkAYAmAYAuAYAwQYBITAAAPA_0AapJdoGFgoQCREZAaAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgHxs8E0gcNCREzATEI2gcGAWhwGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=e07ad8d52b2901cfb37751c66091233d070beb28&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dwfeqdiirq%26e%3D1069342552190,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dwfeqdiirq%26e%3D1069342552190&
Frame ID: 1309B727F8C2E7F1F74D355D9CD30984
Requests: 5 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Frame ID: F342F14BBB03EA7E435D53B608453CB9
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 07860665E3267DDCD22CB136737F5732
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 9E8D826FB60DD5D013BD6403BC3ADC4F
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 4186E47A2224D62455CB2B412676E5B7
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 267CBCB6EF58B238D2BBE11C708AC94D
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Frame ID: 60DF64B99DFC989DBD96E381C383753F
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Frame ID: 9B3B4C78613DF3C6BEE1427F67139B51
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Frame ID: A3CE7AA856C590BC4ACF36DD96AFB2E0
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Frame ID: 0A01E6129F614BEFB2876D7E67AC5344
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/b1b4adf21f61e81a769b8775ed80349d?gdpr_consent=&gdpr=0
Frame ID: 8D29B87977F70263EAEE8F6F4B444053
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Frame ID: 9343127ECCC932632AEC6DE6E16F1FEE
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 5F6B532CF5F9C6785346422C08B6BE15
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Frame ID: CF86DDC684021CAACBC635F84D958F5E
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Frame ID: 302BB82332ABB974861F8932E26A7546
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Frame ID: EA17C70A4C4F3E8B19A9D556202D41B4
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Frame ID: 00B9996F8E848E4353D93CBADCEF3089
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/786d8431951ad79f9258aa2cfb14821?gdpr_consent=&gdpr=0
Frame ID: 0807BFAC7D91D31F99341CD5CB467FC1
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Frame ID: B3458BB7589710F83EC54A7C484A3BC3
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: FB27BD47D7644CD1EE673767DB87CF0F
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Frame ID: B1FBBE7E5D527AF7FE178ED87FED85B6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Frame ID: 1595CED923B607FA4C67E0A09AF46CE1
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Frame ID: F31D942C89F2DB9908063A960FE87BA4
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Frame ID: A0BC8F9BD9975FB3EB9491E4EB57E11D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Frame ID: F5E1A5986F51126A63375C12490588FF
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Frame ID: E76A3A14B2B1BA807FAC755BFFCDA28D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Frame ID: 5C1B44FACB9710D6801630331B4703F9
Requests: 1 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: D1425F1F308AA73D3508D8B542FAB0AE
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/6b571ac5d581a2d9c72211d31d6d776?gdpr_consent=&gdpr=0
Frame ID: 46D51AF3D8B6342009E677A112BC00BC
Requests: 1 HTTP requests in this frame

Frame: https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=1385579407814183431&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjUzNDU%3D%2Fbn%3D75718%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=1385579407814183431&_cb=189151553
Frame ID: 5368985E206A60A694AFE445E6F86B88
Requests: 3 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: ABCF1187AB390D4BE417CE2B2B4231F1
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Frame ID: 240815E114C198C714F8ED9A37E267B8
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Frame ID: 539DDDE4928A7B056207E0C5D68EC8C0
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: E5094DFC1E8DDAB92870F424B6BC543B
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Frame ID: 088950AFFF969D9DF2245F000238EC5D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Frame ID: A1FF971605EBFEC2EBE229D8B89F17ED
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Frame ID: 41E06C43D5A14BC593B00DCBE156AD35
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Frame ID: 053C3A804F27784C16D6DD347B014AA0
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Frame ID: 6521CB9779131DFA35EEF6A969402CDA
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Frame ID: 0464D0C8E27BD47B8CB9516B2201CC3D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/65b81249c63c3f35944c3539c0ecb4?gdpr_consent=&gdpr=0
Frame ID: F750291638BD6ABF039CC24E98A3F06A
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: F29CE5023D86D561299D5ED3CCFB8BAD
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Frame ID: ABB2D296383BF396057B5405DEF67599
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Frame ID: AB193F9F3ECEF80173860CF4EDFA0CB9
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 9C7F3CEAB215B23A8F694B1CDF15EC3A
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: AD52EBF3C09F10995E5486DCB7126E4D
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: B2F9319C3A6D8609E36B470A608AA3CF
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: A10579280A998B78F1E6996C930CB0B3
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: BBC508D2CBFF3DDFB34A41B85EB6FAA7
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 2137F415678D69E572E334D1F15AF05E
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 9898FE66DC380104487A348C63011734
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2EB7DE8AF4C3A8A236197F73A6824C2D
Requests: 2 HTTP requests in this frame

Frame: https://c1.adform.net/serving/cookie/match?party=14&cid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Frame ID: BFB01462E79305DCEE9D56C22C0FEE04
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 519DA48D0877F3034CE8849C72D37F42
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: B0F1EBA7F652EA21CF2FE4A84A439007
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: D2A45B38CA1B546127F83D20FE8DDFB4
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Frame ID: A589771DF6CA183A38E9829CED0CAE8D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Frame ID: CEAB883F68EEB2DE35BDCEA9FFD07DEB
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Frame ID: A06EBF80011BC5DB83DD2C7F9DABFD41
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/973f48b68d39913ead7b63a7ed88bc5?gdpr_consent=&gdpr=0
Frame ID: B4A11566EF36E911DE98CE1A82258DBA
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: A3816726FC75D707549051EEAB7312CD
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: CBB3A51EFCE72AFD823F2BEDA4A8CF13
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 8ED0E11D8189C5F68F498B506AA9B5FD
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 7BCAB2BC2105A4E42E88CD8E9BC409CC
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Frame ID: 86208A69D20DDFD8BE21DE255DB707F1
Requests: 1 HTTP requests in this frame

Frame: https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
Frame ID: 663EA22EC3EB3AD0B348C417153B3493
Requests: 1 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Frame ID: B36EE93DC3003AE498F58FC385961F5E
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
Frame ID: 77E21786941EB6D3F354B473D3A27864
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: DBE7C8B658B34988CD778958BA63B727
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
Frame ID: E841ED8FA04A2A7AF8EA6EAAA0E17033
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
Frame ID: 44EAF9731697794594C4606D2856E2F1
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: AEB2440A03E7EB8408F9D255FF7CE93B
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Frame ID: CC5480E219417378502C8F6062F55F07
Requests: 1 HTTP requests in this frame

Frame: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Frame ID: 9946CB3B70F30877E3D793FB6FD894FD
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Frame ID: 7A624BDF44752B78EC310D074F7C0BD6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Frame ID: 6A5E8D81293C43661C745567820953D6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/da3024658895bd5e79dc0b645ffc08?gdpr_consent=&gdpr=0
Frame ID: A58D4C2011FEF5493AA7BA3C1B753B05
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Frame ID: 7467067B63978106C9E9B14A4148A6EE
Requests: 1 HTTP requests in this frame

Frame: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Frame ID: 51A7B38E454E7781D2B4398742332246
Requests: 10 HTTP requests in this frame

Frame: https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
Frame ID: 82DFA24A035364657F3E3D7CB16AB660
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Frame ID: 04335D077AA5CF7E0A82D85FAE6651EF
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/connectad/VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy
Frame ID: 9ACA0F90051C7010132A428ACA27D805
Requests: 1 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
Frame ID: EF3FE6E8ABC4AD2F5540E1645AD5ED95
Requests: 1 HTTP requests in this frame

Frame: https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Frame ID: 3444C2342265B583BA0E6CB3048E7E1F
Requests: 1 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
Frame ID: C56D6A34D4FDC4F9BFF66FBBF14E39FA
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Frame ID: EBC19AD3C2820912BC3D9270C0676094
Requests: 8 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
Frame ID: 688287644D01FD8B8399F3DEA723C0E6
Requests: 1 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Frame ID: 277A7FAB32F20B12653F830D24ECCB37
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
Frame ID: B84716B9BAC6DA355D8BBD958301FC6D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
Frame ID: 6E3D6E357C44D80633B5598A6EE00DE3
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
Frame ID: 3ECE74958FAC407399FFF7F0D7B4D6F9
Requests: 1 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?dataid=data1&uuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Frame ID: E291BED6952B341B28CC7D87A91DBD43
Requests: 1 HTTP requests in this frame

Frame: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Frame ID: EB8E83D9616C0565A29E5630CD453EF0
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: E94B45F8C8FD4DDE4A3829F8B4DC4362
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 920D4C35F53E5AB98F629A49C8287CD9
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Frame ID: A7DE994A253CAABBA1E862E9BA0121B4
Requests: 1 HTTP requests in this frame

Frame: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Frame ID: F6AC0EA28770D1EA3389FDF2BD2FDFFB
Requests: 10 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
Frame ID: 7EA87875221E9C7EEF33B773765AC428
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Frame ID: C84BC8984B764BD905F7865582C54E85
Requests: 8 HTTP requests in this frame

Frame: https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Frame ID: 352B9820765B588FBDAE1A9C9D9A8C1C
Requests: 1 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
Frame ID: DBA46E39007EC103B645778D915BF5EB
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/connectad/VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy
Frame ID: 0E437F29E2683255AFF5C7C333C88BBE
Requests: 1 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
Frame ID: 391780FF1AAF46BF0AF78151378700A1
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 3897FD9B58E6AD7ADDA5CD782703AAC1
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 181E744ED6225A83038D996B9BCAB9D5
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 7A2BE2D9E4B1A6D367B6F8B669A624B8
Requests: 2 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?dataid=data1&uuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Frame ID: 1E4D34C5E38F305FD4EA481F654F882F
Requests: 1 HTTP requests in this frame

Frame: https://us-match.taboola.com/sync?dast=V8NMUCLAbgGQEK4mdf3xLAMwIUxM--vi0AAABgYID-AAl5fLONbTFyK3cTx1o0GtncCo9juRYuJw6XwznxeDyWISAhj2-2sS1GbuVu4liLRiObW-FxLNfC5cThcjgnHo_HMgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRA-mcjUJE3zXyIEjUUYAQAAAKjEyZQ9MkknqFhU-f__77cCcAUAIABRuyocNIvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjmIxcvoXNOXO4TA6PyTaZ2RwTi8NkWa4MM8dqeyRjf1xaaPRh-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3Ox2XhMa8XMsnGLFjbfWrhZLtcqy8w1srg2y5lhsxa9PqaLcWLcDRZbJBiwuBfJ0yKdKGcu32K5WplmvtXItZk5ZibHardZuZzL1WY4M0zEEs3JIp3ILvuOYTJy-RY258zhMjk8JttkZnNMLA6TZbkyzByrfcfkXGw2HtNaMbNs3KKFzbcWbpbLtcoyc40srs1yZtisRa-P6WKcGHeDxb4xG-4my8FktNg3ZsPdZDmYjBb7Dp3hu_qcjdLJUuzxaRfGcktncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrtgNVwkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrHHryAGw8lg_wBUiLVarW431mq1AA!&excid=22&docw=0&cijs=1&nlb=false
Frame ID: CE215ADE112B3B4E2158029346947532
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Meghan Markle earned more than The Weeknd for '12 hours work': Spotify

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • //maps\.google(?:apis)?\.com/maps/api/js
Overall confidence: 100%
Detected patterns
  • accounts\.google\.com/gsi/client
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • (?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • tpc\.googlesyndication\.com/safeframe
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • moatads\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • /polyfill\.min\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • //s\.btstatic\.com/tag\.js
Overall confidence: 100%
Detected patterns
  • <iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
  • \.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

994
Requests

78 %
HTTPS

23 %
IPv6

175
Domains

290
Subdomains

178
IPs

12
Countries

11798 kB
Transfer

29778 kB
Size

319
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 47
  • https://unpkg.com/web-vitals@3/dist/web-vitals.iife.js HTTP 302
  • https://unpkg.com/web-vitals@3.3.2/dist/web-vitals.iife.js
Request Chain 91
  • https://pixel.sitescout.com/dmp/asyncPixelSync HTTP 302
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Request Chain 95
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1687290240615&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1687290240615&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
Request Chain 96
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de HTTP 302
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
Request Chain 127
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
Request Chain 128
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
Request Chain 129
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=&xl8blockcheck=1 HTTP 302
  • https://load77.exelator.com/pixel.gif
Request Chain 131
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=&ct=y
Request Chain 136
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1627 HTTP 301
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Request Chain 164
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Request Chain 193
  • https://rp.liadm.com/j?dtstmp=1687290242330&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4 HTTP 302
  • https://rp4.liadm.com/j?dtstmp=1687290242330&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjEw&n3pc=true
Request Chain 197
  • https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302918421454631000V10
Request Chain 198
  • https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=95cec808
Request Chain 206
  • https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Request Chain 207
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4614819635623485669&gdpr=0&gdpr_consent=
Request Chain 208
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0 HTTP 302
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=5fa0069656320604&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAB5mRHm00XWQN-vi56AAAAAAA&expiration=1687376643&is_secure=true&gdpr=0
Request Chain 213
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint HTTP 302
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Request Chain 238
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=1179662177681492769&ex=appnexus.com&gdpr=0
Request Chain 239
  • https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 HTTP 301
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 HTTP 302
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Request Chain 241
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0 HTTP 302
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3110826783617533917
Request Chain 249
  • https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID HTTP 302
  • https://usersync.gumgum.com/usersync?b=apn&i=1179662177681492769
Request Chain 250
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://beacon.lynx.cognitivlabs.com/bidSwitch.gif?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=425&user_group=1&expires=365&user_id=50113f91-7ace-4204-934b-46770b6d07a4&ssp=gumgum2&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 302
  • https://usersync.gumgum.com/usersync?b=bsw&i=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
Request Chain 251
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=sta&i=0-72e8f41c-c614-5c44-7a44-34baa58f8010$ip$149.56.153.178
Request Chain 252
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=7dYANMJyrp6NSRwK_hfM&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2N3ELFAU4TKKPFZHANSOKNJHOS27NBTE2&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2N3ELFAU4TKKPFZHANSOKNJHOS27NBTE2 HTTP 302
  • https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=7dYANMJyrp6NSRwK_hfM
Request Chain 253
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
  • https://usersync.gumgum.com/usersync?b=pln&i=VttZoBj38cya&ev=1&pid=558355
Request Chain 254
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
  • https://usersync.gumgum.com/usersync?b=obn&i=ENC%28HIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28HIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz%29%26gdpr%3D0 HTTP 302
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&obuid=ENC(HIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz)&gdpr=0 HTTP 302
  • https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0 HTTP 302
  • https://s.ad.smaato.net/c/?adExInit=o&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmaato%26uid%3D%24UID%26obUid%3DHIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz%26gdpr%3D0%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%26initiator%3Dplatform HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=smaato&uid=95cec808&obUid=HIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz&gdpr=0&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
Request Chain 255
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://usersync.gumgum.com/usersync?b=opx&i=cbb4f35f-fea3-4d69-b8db-562a48262f0e
Request Chain 256
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=oth&i=y-V0bxrfdE2pf5kfcjU0BcOqdnzLDBVRMrd1TZ~A
Request Chain 257
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
  • https://usersync.gumgum.com/usersync?b=vnt&i=880a98a2-e5e4-4836-b912-8db1e124443a
Request Chain 258
  • https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D HTTP 307
  • https://usersync.gumgum.com/usersync?b=snc&i=568200899A48499D9AF846BF5A46F6A4
Request Chain 260
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://usersync.gumgum.com/usersync?b=idi&i=5adef92e-e872-4286-a590-6f8c8cb526ab
Request Chain 261
  • https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=sad&i=4614819635623485669
Request Chain 263
  • https://match.adsrvr.org/track/cmf/casale HTTP 302
  • https://match.adsrvr.org/track/cmb/casale HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&expiration=1689882243&gdpr=0&gdpr_consent=
Request Chain 264
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJIBgknqWgpSPnqrMo17egAADtAAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKa_mgT-DNgDy_HVokz8O9s&google_cver=1
Request Chain 266
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJIBgknqWgpSPnqrMo17egAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAAKOKRyT_pEOVlAljd9ZuI&google_cver=1
Request Chain 267
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1 HTTP 302
  • https://casale-match.dotomi.com/match/bounce/current?DotomiTest=132e08a4860f15d8&is_secure=true&networkId=19998&version=1 HTTP 302
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAACIySjnRRLawMe994IAAAAAAA&expiration=1687376643&is_secure=true
Request Chain 268
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=ZJIBgwATV5hRfwBa HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJIBgwATV5hRfwBa&_test=ZJIBgwATV5hRfwBa
Request Chain 269
  • https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_user_id=ZJIBgknqWgpSPnqrMo17egAA HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum&cm_user_id=ZJIBgknqWgpSPnqrMo17egAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662097701423574
Request Chain 270
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=1179662177681492769
Request Chain 272
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=azIwV1ZKRGl4X3lpWk5oM0haREVmZw&gdpr=0&gdpr_consent= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEGPuUHjqtKix2YVOu27mPRk&google_cver=1
Request Chain 273
  • https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid= HTTP 302
  • https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=5930cb5c4e515d8&is_secure=true&networkId=14200&version=1&nuid= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAHwrPka_LWIgNQwSkJAAAAAAA&expiration=1687376643&nuid=&is_secure=true
Request Chain 278
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Request Chain 279
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Request Chain 280
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Request Chain 281
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1179662177681492769
Request Chain 283
  • https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c HTTP 302
  • https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEL66ASCQJ_Y4vrCm-P3-keo&google_cver=1
Request Chain 284
  • https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an HTTP 302
  • https://ads.yieldmo.com/v000/sync?userid=1179662177681492769&pn_id=an
Request Chain 285
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.yieldmo.com%252Fsync%253Fpn_id%253Dpub%2526id%253D%2523PMUID%2526gdpr%253DPM_GDPR%2526gdpr_consent%253DPM_CONSENT HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.yieldmo.com%252Fsync%253Fpn_id%253Dpub%2526id%253D%2523PMUID%2526gdpr%253DPM_GDPR%2526gdpr_consent%253DPM_CONSENT&rdf=1
Request Chain 286
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&redir%3Dhttps%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3D%5BRX_UUID%5D HTTP 302
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&zcc=1&cb=1687290243519 HTTP 302
  • https://ad.turn.com/r/cs?pid=45&rndcb=8271417778 HTTP 302
  • https://sync.1rx.io/usersync/turn/8529793602827949306?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3DRX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005 HTTP 302
  • https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Request Chain 287
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3107&partner_device_id=gb63ffdf5e8844fc2dd8 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=76c19607-052e-43a5-b5b2-1d6cfe831e64%252C%252C&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&ttd_puid=76c19607-052e-43a5-b5b2-1d6cfe831e64%2C%2C
Request Chain 292
  • https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212190061405193
Request Chain 293
  • https://csync.loopme.me/?pubid=11362&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11571%26id%3D%7Bdevice_id%7D HTTP 307
  • https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
Request Chain 295
  • https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.yellowblue.io/cs?aid=11601&id=52cb64774129a9aa101be8ca6e9d9d3&gdpr_consent=&gdpr=0
Request Chain 296
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=b906d225-1d58-4500-8893-66f3b5de01e6
Request Chain 297
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11596%26id%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=1179662177681492769&gdpr=0&gdpr_consent=
Request Chain 298
  • https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.yellowblue.io/cs?aid=11587&uid=35620282-96f1-466f-b370-6daf818c9a83&gdpr=0
Request Chain 299
  • https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent=&verify=true HTTP 302
  • https://cs.yellowblue.io/cs?aid=11591&id=y-GBn6EsNE2uJwaSvumh901S2KVPmsEqlX~A&gdpr_in_effect=0
Request Chain 300
  • https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D115667%26uid%3D%5BUID%5D HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=7f6700ef-9efd-41da-8a71-72c3ea800d51
Request Chain 301
  • https://us-u.openx.net/w/1.0/cm?id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=d4894bb9-0159-487a-94e7-1a55a1dffa0b
Request Chain 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&rdf=1
Request Chain 307
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=ttd&i=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Request Chain 308
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
  • https://usersync.gumgum.com/usersync?b=mmh&i=c0d66492-0183-4f00-930f-e67415c7188d&gdpr=0&gdpr_consent=
Request Chain 309
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=mercurynews.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=lHABFnw1NmM5MmdSR3R0ZEVyZ3B1d2p4N09VeWMxMEphYXlxTnk4a1hBc1NVWlJEeWlJYWFPWWRFaDExQXJUa3Q4NmZWeWRRbXdLQWZ5Rjg0TWhnSm9KMjJBSVBPVGQrcWZBbmZReU55NTI1QmpJUUo1cElTY3d1RTkyUzVCQzlzanhwLzExTjVaR2NuNkdjanorLy9oZUtZbDFPZ2JvR1JmOXFhUU9jMlR4WFV1aTNoSUNTSnNuTGtFU285aHlzc0ZZVFppTk9iSGtFOHBqSk1DeWJDNVlHcmVEcnJZbVAzdUNhK05Bb2IxUzQvc1AycEdJZDJMUUVaMzRheTRJZzRjVCtzazFBWjIzZElMNXU3ayttSWdsL3RxZz09fA&cppv=2
Request Chain 311
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Request Chain 316
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=atm&i=ZJIBgwATV5hRfwBa&gdpr=0&gdpr_consent=
Request Chain 318
  • https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
  • https://usersync.gumgum.com/usersync?b=sus&i=ZJIBg8Co8YQAAMZ2WjUAAAAA
Request Chain 321
  • https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
  • https://usersync.gumgum.com/usersync?b=rth&i=2LK2FelB5bz5w6flSs8Z&pi=gumgum&tc=1
Request Chain 322
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=gumgum
Request Chain 328
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=80&3pid=LJ4P1MPG-1E-GIGU&gdpr=0
Request Chain 329
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP 303
  • https://ce.lijit.com/merge?pid=85&3pid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
Request Chain 330
  • https://cms.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=43&gdpr=0&3pid=sxggjbUdIY6oTSnZ4Ek02rJJfIioSnrZskq7SIl1
Request Chain 332
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=87&3pid=967ba71f-887a-40cd-a2cb-fd1cbcd221c2
Request Chain 340
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&khaos=LJ4P1MPG-1E-GIGU HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=LJ4P1MPG-1E-GIGU&ex=d-rubiconproject.com&status=ok&gdpr=0
Request Chain 344
  • https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=4160af57-86ed-4458-b49b-256a547d062b&us_privacy=1--- HTTP 302
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=8df8ba75-afab-4bc2-a76d-d979183f805a%3A1687290243.9165657&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D8df8ba75-afab-4bc2-a76d-d979183f805a%253A1687290243.9165657%26_%3D1687290243.919931&cb=1687290243.919967 HTTP 302
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=968062838393799053&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D8df8ba75-afab-4bc2-a76d-d979183f805a%253A1687290243.9165657%26_%3D1687290243.919931 HTTP 302
  • https://idsync.rlcdn.com/501709.gif?partner_uid=8df8ba75-afab-4bc2-a76d-d979183f805a%3A1687290243.9165657&_=1687290243.919931 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CM3PHhJBCj0IARAFGjc4ZGY4YmE3NS1hZmFiLTRiYzItYTc2ZC1kOTc5MTgzZjgwNWE6MTY4NzI5MDI0My45MTY1NjU3EAAaDQiFg8ikBhIFCOgHEABCAEoA HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEK5vvHT8FBTgMazEsUNFxbY&google_cver=1
Request Chain 345
  • https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=8301830339311477822&us_privacy=1--- HTTP 303
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-XFAtpQOBfkjgb_G6Me-kjLYL4fqlvUyXLrG7JQ&us_privacy=1---
Request Chain 346
  • https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=4160af57-86ed-4458-b49b-256a547d062b&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 303
  • https://x.bidswitch.net/sync?ssp=liveintent&user_id=4160af57-86ed-4458-b49b-256a547d062b HTTP 302
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 302
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=0443731d-ef67-4c6c-86ad-2109fa610bab&user_group=1&ssp=liveintent&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 302
  • https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Request Chain 347
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022 HTTP 303
  • https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Request Chain 349
  • https://b1sync.zemanta.com/usersync/liveintent/?cb=//i.liadm.com/s/35004?bidder_id%3D98254%26bidder_uuid%3D__ZUID__&us_privacy=1--- HTTP 302
  • https://stags.bluekai.com/site/23178?id=7dYANMJyrp6NSRwK_hfM&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DF4XWSLTMNFQWI3JOMNXW2L3TF4ZTKMBQGQ7WE2LEMRSXEX3JMQ6TSOBSGU2CMYTJMRSGK4S7OV2WSZB5G5SFSQKOJVFHS4TQGZHFGUTXJNPWQZSNEZSXQY3IMFXGOZJ5NRUXMZLJNZ2GK3TUEZ2XGX3QOJUXMYLDPE6TCLJNFU&us_privacy=1--- HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=F4XWSLTMNFQWI3JOMNXW2L3TF4ZTKMBQGQ7WE2LEMRSXEX3JMQ6TSOBSGU2CMYTJMRSGK4S7OV2WSZB5G5SFSQKOJVFHS4TQGZHFGUTXJNPWQZSNEZSXQY3IMFXGOZJ5NRUXMZLJNZ2GK3TUEZ2XGX3QOJUXMYLDPE6TCLJNFU HTTP 302
  • https://i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=7dYANMJyrp6NSRwK_hfM&us_privacy=1---
Request Chain 350
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=4160af57-86ed-4458-b49b-256a547d062b&us_privacy=1--- HTTP 302
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=4160af57-86ed-4458-b49b-256a547d062b&us_privacy=1---&rd=Y
Request Chain 364
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=jofNXuhjSfSBAUnmPj1L2Q%3D%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Request Chain 365
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=8E87CD5E-E863-49F4-8101-49E63E3D4BD9 HTTP 302
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D76c19607-052e-43a5-b5b2-1d6cfe831e64%252C%252C HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1179662177681492769&pt=76c19607-052e-43a5-b5b2-1d6cfe831e64%2C%2C
Request Chain 367
  • https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent= HTTP 302
  • https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&vxii_pid=12&vxii_pid1=10067&vxii_rcid=79a00523-d7f6-4653-bec7-3715ffc94b28
Request Chain 368
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OEU4N0NENUUtRTg2My00OUY0LTgxMDEtNDlFNjNFM0Q0QkQ5&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 369
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECwE4banhqfisdfFzHL7LsM&google_cver=1
Request Chain 370
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:FCA67877EA764E1F821EE4EC1A0C959E
Request Chain 371
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8301830339311477822&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 372
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Request Chain 373
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=OiTEf5__RBaAQd8MtqczmQ&rk=usync-na&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=OiTEf5__RBaAQd8MtqczmQ&gdpr=0
Request Chain 375
  • https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=LJ4P1MPG-1E-GIGU&ex=d-rubiconproject.com&status=ok&gdpr=0
Request Chain 376
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESECqw6-icfhlaZAbUMRe6mSI&google_cver=1
Request Chain 377
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZGQzNzllOTgwODM5NWExYThkOTNjMWQ2NmMwYzMzYTlhOTM4N2Y3OA&gdpr=0
Request Chain 378
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/M2IIyuPC-IwEStNikcHoa8n5EUdSAgOZEtemQ7w0kco?csrc=&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-__a7VMFE2oL_Nlnuz340pGQqZKwO_GK8yLWsvA--~A
Request Chain 379
  • https://token.rubiconproject.com/token?pid=25470&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo0UDFNUEctMUUtR0lHVQ==&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESEPRDEf3WUYhP8y9VYwLJdPs&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UDFNUEctMUUtR0lHVQ==&google_push=&gdpr=0
Request Chain 380
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=&expires=30
Request Chain 392
  • https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&gdpr_consent=undefined&gdpr=0&khaos=LJ4P1MPG-1E-GIGU HTTP 302
  • https://usersync.gumgum.com/usersync?b=mag&i=LJ4P1MPG-1E-GIGU&gdpr=0&gdpr_consent=undefined
Request Chain 393
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr_consent=undefined&gdpr=0&khaos=LJ4P1MPG-1E-GIGU HTTP 302
  • https://cs.yellowblue.io/cs?aid=11590&id=LJ4P1MPG-1E-GIGU&gdpr=0&gdpr_consent=undefined
Request Chain 407
  • https://tg.socdm.com/aux/idsync?proto=taboola HTTP 302
  • https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBg8Co8YQAAMZ2WjUAAAAA
Request Chain 408
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__ HTTP 302
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__&nut&uu=7e7e6a26c4614795a39d50bb401edffb HTTP 302
  • https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=7e7e6a26c4614795a39d50bb401edffb
Request Chain 410
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698 HTTP 302
  • https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4P1MPG-1E-GIGU
Request Chain 411
  • https://pr-bh.ybp.yahoo.com/sync/taboola/cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701?gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ocRLxGNE2oReUjEympH9QO9IbxKnVQjHIbublg--~A
Request Chain 412
  • https://trace.mediago.io/ju/cs/taboola HTTP 302
  • https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=00330d6dd843346dbfa2c28e0164fa30
Request Chain 413
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc HTTP 302
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEBlFnRCSMfP6ZCFtK8QMK5Q&google_cver=1
Request Chain 415
  • https://sync.taboola.com/sg/google-network/1/rtb/?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701
Request Chain 416
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Request Chain 420
  • https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=e4d4e64e-e370-4886-a057-02f441b10d0f
Request Chain 421
  • https://id5-sync.com/s/464/9.gif?puid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%7BID5UID%7D HTTP 302
  • https://id5-sync.com/c/464/464/7/1.gif?puid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/264.gif?puid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&ttl=%%TTL%% HTTP 302
  • https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F434%2F5%2F3.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent= HTTP 302
  • https://id5-sync.com/c/464/434/5/3.gif?puid=7f6700ef-9efd-41da-8a71-72c3ea800d51&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F4%2F4.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/441/4/4.gif?puid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&gdpr=0&gdpr_consent= HTTP 302
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/464/2/3/5.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/2/3/5.gif?puid=1179662177681492769&gdpr=0&gdpr_consent= HTTP 302
  • https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F2%2F6.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F2%2F6.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/464/112/2/6.gif?puid=7D6AE0D8CA7C0A32&gdpr=0&gdpr_consent= HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F429%2F1%2F7.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
  • https://id5-sync.com/c/464/429/1/7.gif?puid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-404b5IlA-MM2sBNTwoXVCFNDOZsXFrSWDrEHq111qQ&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F3%2F0%2F8.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/3/0/8.gif?puid=c0d66492-0183-4f00-930f-e67415c7188d&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-404b5IlA-MM2sBNTwoXVCFNDOZsXFrSWDrEHq111qQ
Request Chain 422
  • https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=taboola&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=968062838393799511&expires=30&ssp=taboola HTTP 302
  • https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Request Chain 423
  • https://rtb.mfadsrvr.com/sync?ssp=taboola HTTP 302
  • https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=967ba71f-887a-40cd-a2cb-fd1cbcd221c2 HTTP 302
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=967ba71f-887a-40cd-a2cb-fd1cbcd221c2&tbid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&query=taboola_hm%3D967ba71f-887a-40cd-a2cb-fd1cbcd221c2&isDirect=0
Request Chain 426
  • https://sync.srv.stackadapt.com/sync?nid=140 HTTP 302
  • https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=cuj0HMYUXER6RDS6pY-AEJU4mbI
Request Chain 428
  • https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&ph=295bf259-a378-4089-aae8-a2a995ba8627&id=37f45540-fa88-4005-bf73-8a7ac39467e3&r=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fopenxrtb-network%2F1%2Frtb-h%2F%3Fgdpr%3D0%26us_privacy%3D1---%26orig%3Dvideo%26taboola_hm%3D HTTP 302
  • https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=bbb3b40c-3cb7-4468-ad0e-4741210b8afc
Request Chain 429
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=121&0&&us_privacy=1---&redir= HTTP 302
  • https://sync.taboola.com/sg/centrortb-network/1/rtb-h/?taboola_hm=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
Request Chain 482
  • https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=image HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=gb63ffdf5e8844fc2dd8 HTTP 302
  • https://ads.yieldmo.com/v000/sync?tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Request Chain 483
  • https://dsum.casalemedia.com/pbusermatch?origin=prebid&site_id=945271&p=1&i=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48 HTTP 302
  • https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
Request Chain 484
  • https://eb2.3lift.com/sync?px=1&src=prebid&us_privacy=1---& HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&dongle=0cfd&gdpr=0&gdpr_consent=
Request Chain 485
  • https://image8.pubmatic.com/AdServer/ImgSync?p=162935&us_privacy=1--- HTTP 302
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&redir=true&gdpr=-1&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-mPTotEpE2uVjindUKBP5sJCUhB9yLyY-~A
Request Chain 559
  • https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968062838393799511 HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Request Chain 561
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:c0d66492-0183-4f00-930f-e67415c7188d&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Request Chain 562
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent= HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEOExFN0pKQU1BQUItUS11NHNGUQ&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAD8LE7JJAMAAB-Q-u4sFQ&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsyn%252Csas%252Cpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=syn%2Csas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAD8LE7JJAMAAB-Q-u4sFQ&pid=558502&do=add&gdpr=0 HTTP 303
  • https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AAD8LE7JJAMAAB-Q-u4sFQ&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3&gdpr=0 HTTP 307
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=3 HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4%26userid%3DSMART_USER_ID&gdpr=0 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=4614819635623485669&gdpr=0&gdpr_consent= HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Request Chain 563
  • https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent= HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_997d12a216e84889bc024 HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Request Chain 564
  • https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1179662177681492769&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Request Chain 571
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent= HTTP 302
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=d50e1659d250559&is_secure=true&networkId=17100&version=1&nuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACG66zQrHM8QMaOwzmAAAAAAA&expiration=1687376647&nuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&is_secure=true&gdpr_consent=&gdpr=0
Request Chain 572
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=880a98a2-e5e4-4836-b912-8db1e124443a&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33647_1049454A6_B75A6C7A&r=https://pmp.mxptint.net/sn.ashx?ak=1
Request Chain 573
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ssp%3Dpubmatic%26user_id%3D%24UID HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=440&ssp=pubmatic&user_id=hCrG6A0yBhVYst6iy0I_0 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 614
  • https://pixel.sojern.com/pixel/img/291730?p_v=1&f_v=v3_image&vid=hot HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=i0oiyxswN32k7uFulsIA5w&google_nid=sojern__adx_open_bidder_seat&sjrn_id=UYQdtTQc4KALWt5Ce5XO5YqbMj8ZCcNj08bZoW3aV0axAFRET7XrAdcxsgBu0W21&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_ula=6514084203 HTTP 302
  • https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=UYQdtTQc4KALWt5Ce5XO5YqbMj8ZCcNj08bZoW3aV0axAFRET7XrAdcxsgBu0W21&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_ula=6514084203&google_gid=CAESELoCfF1wTY3vred3XwfrqLg&google_cver=1 HTTP 307
  • https://secure.adnxs.com/px?id=1528961&t=1
Request Chain 666
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Request Chain 667
  • https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%26partneruserid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=2900c0d7-4774-4a53-9832-f8fba665f58e
Request Chain 668
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 669
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4614819635623485669&gdpr=0&gdpr_consent=
Request Chain 685
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=4614819635623485669&gdpr=0&gdpr_consent=
Request Chain 686
  • https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.adstanding.com/ssp/bidswitch/cookie?bidswitch_ssp_id=smartadserver&bidswitch_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=317&user_id=4cb975a7186b097f02ae275c059e0902&expires=30&ssp=smartadserver&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=
Request Chain 687
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?&rd=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D91%26partneruserid%3D%23PM_USER_ID%26gdpr%3DPM_GDPR%26gdpr_consent%3DPM_CONSENT&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Request Chain 688
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partneruserid%3DPARTNER_USER_ID%26gdpr%3DGDPR%26gdpr_consent%3DGDPR_CONSENT&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=d32ed1d1d06612715aa282670b9dccf4&gdpr=0&gdpr_consent=0
Request Chain 689
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=XFx9J1pZfCRHCXRzDw1pcF0NISJHDidzXQ5V9vm3
Request Chain 697
  • https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent= HTTP 302
  • https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=smartadserver&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=283&user_id=cf778d1d-d203-4e00-b50f-6457d4a0869b&expires=1&user_group=2&ssp=smartadserver&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=&gdpr_pd= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=
Request Chain 698
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partneruserid%3DPARTNER_USER_ID%26gdpr%3DGDPR%26gdpr_consent%3DGDPR_CONSENT&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=d32ed1d1d06612715aa282670b9dccf4&gdpr=0&gdpr_consent=0
Request Chain 699
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 700
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=35620282-96f1-466f-b370-6daf818c9a83&gdpr=0
Request Chain 701
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent= HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
Request Chain 727
  • https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zF7KIcpbyyLXC8N1nw_eds0PliTXDJB1zQzLDEcp
Request Chain 728
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d47e24dc-0fa2-11ee-ac94-72b4b480830c
Request Chain 729
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Request Chain 730
  • https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=cuj0HMYUXER6RDS6pY-AEJU4mbI&gdpr=0&gdpr_consent=
Request Chain 731
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:NWVHfDIW1QbHgT5&gdpr=0&gdpr_consent=
Request Chain 732
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=50113f91-7ace-4204-934b-46770b6d07a4&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP 302
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Request Chain 733
  • https://ums.acuityplatform.com/tum?umid=6 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501171541
Request Chain 734
  • https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent= HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Request Chain 736
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4475188502 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/59f17c06-c5d2-4b1e-89aa-3d64ff091022 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Request Chain 737
  • https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token} HTTP 307
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Request Chain 738
  • https://gocm.c.appier.net/pubmatic HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=eTsnmm5VDg6trxz8jAGSZA
Request Chain 740
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=a457c9e9-2914-4c4f-865e-b60bc0f898f7
Request Chain 743
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7405766521439522184&uid=Q7405766521439522184&ref=%2Fepm HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766521439522184
Request Chain 744
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:FCA67877EA764E1F821EE4EC1A0C959E&gdpr=0&gdpr_consent=
Request Chain 745
  • https://idsync.rlcdn.com/712188.gif?partner_uid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent= HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=ddd341f48edd8544487039c681569751b5788b7f9c24d5845205132461989c45791426b5417dce21&_=2 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBkZGQzNDFmNDhlZGQ4NTQ0NDg3MDM5YzY4MTU2OTc1MWI1Nzg4YjdmOWMyNGQ1ODQ1MjA1MTMyNDYxOTg5YzQ1NzkxNDI2YjU0MTdkY2UyMRAAGgwIjIPIpAYSBAgCEABCAEoA HTTP 302
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBkZGQzNDFmNDhlZGQ4NTQ0NDg3MDM5YzY4MTU2OTc1MWI1Nzg4YjdmOWMyNGQ1ODQ1MjA1MTMyNDYxOTg5YzQ1NzkxNDI2YjU0MTdkY2UyMRAAGgwIjIPIpAYSBAgCEABCAEoA&google_gid=CAESEO9o--Fx6PornArhLyItJ1Y&google_cver=1 HTTP 307
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
  • https://idsync.rlcdn.com/458249.gif?partner_uid=403238cf-5851-423a-9dbf-f9cc07c258c7
Request Chain 749
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1598040676591792150
Request Chain 750
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=1179662177681492769
Request Chain 751
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:59a5b5f7-4084-4fca-af03-1a5d040bf2c3&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Request Chain 755
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Request Chain 756
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsync.richaudience.com%2F1a12a024f8f9561c49164bbaf87ed164%2F%3Fuid%3D[sas_uid]&gdpr_consent=&nwid=2441/ HTTP 302
  • https://sync.smartadserver.com/getuid?url=https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=[sas_uid]&gdpr_consent=&nwid=2441/&cklb=1 HTTP 302
  • https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4614819635623485669
Request Chain 759
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F2069.66%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=167503462 HTTP 302
  • https://sync.1rx.io/usersync3/mediamathtest/2069.66/c0d66492-0183-4f00-930f-e67415c7188d?zcc=0&sspret=1 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Request Chain 764
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Request Chain 770
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Request Chain 775
  • https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1598040676591792150&gdpr=0&gdpr_consent=
Request Chain 776
  • https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent= HTTP 302
  • https://stags.bluekai.com/site/23178?id=7dYANMJyrp6NSRwK_hfM&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC4TUNZSXE5LTMVZGSZB5G5SFSQKOJVFHS4TQGZHFGUTXJNPWQZSN&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC4TUNZSXE5LTMVZGSZB5G5SFSQKOJVFHS4TQGZHFGUTXJNPWQZSN HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=7dYANMJyrp6NSRwK_hfM
Request Chain 777
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=150&partneruserid=0&redirurl=https%3A%2F%2Fwt.rqtrk.eu%3Fpid%3D58a76248-f101-4e52-b8f7-c4de9362ea12%26src%3Dwww%26type%3D100%26sid%3D0%26uid%3DSMART_USER_ID%26gdpr_pd%3D0&gdpr=0&gdpr_consent= HTTP 302
  • https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=4614819635623485669&gdpr_pd=0&gdpr=0&gdpr_consent=
Request Chain 778
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIBgwATV5hRfwBa&gdpr=0&gdpr_consent=
Request Chain 779
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
Request Chain 780
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Request Chain 781
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Request Chain 782
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Request Chain 783
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005&rndcb=6833292075 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6&google_hm=YjkwNmQyMjUtMWQ1OC00NTAwLTg4OTMtNjZmM2I1ZGUwMWU2 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEKeIIuep3Xkerh_lyfI-wV0&google_cver=1&ssp=adconductor&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/b906d225-1d58-4500-8893-66f3b5de01e6?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Request Chain 784
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/b1b4adf21f61e81a769b8775ed80349d?gdpr_consent=&gdpr=0
Request Chain 785
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Request Chain 786
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 787
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Request Chain 788
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Request Chain 789
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Request Chain 790
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Request Chain 791
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/786d8431951ad79f9258aa2cfb14821?gdpr_consent=&gdpr=0
Request Chain 792
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Request Chain 793
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 794
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Request Chain 795
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Request Chain 796
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005&rndcb=7373225786 HTTP 302
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=adconductor HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=1598040676591792150&ssp=adconductor HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/b906d225-1d58-4500-8893-66f3b5de01e6?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Request Chain 797
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Request Chain 799
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Request Chain 800
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Request Chain 801
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Request Chain 804
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/6b571ac5d581a2d9c72211d31d6d776?gdpr_consent=&gdpr=0
Request Chain 806
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 807
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Request Chain 808
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Request Chain 820
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Request Chain 822
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Request Chain 823
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&rndcb=4731358763 HTTP 302
  • https://sync.1rx.io/usersync/rubicon/LJ4P1MPG-1E-GIGU HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Request Chain 824
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Request Chain 826
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Request Chain 827
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Request Chain 828
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/65b81249c63c3f35944c3539c0ecb4?gdpr_consent=&gdpr=0
Request Chain 829
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 830
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Request Chain 831
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Request Chain 837
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:6swk5ma&fmt=3 HTTP 302
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022 HTTP 302
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Request Chain 838
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:z2z62d3&fmt=3 HTTP 302
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022 HTTP 302
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Request Chain 839
  • https://insight.adsrvr.org/track/pxl/?adv=64gxdrp&ct=0:1ingnzv&fmt=3 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022 HTTP 302
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Request Chain 851
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
Request Chain 852
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4614819635623485669&gdpr=0&gdpr_consent=
Request Chain 853
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent= HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
Request Chain 854
  • https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=smartadserver&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=smartadserver&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=9196abb7-eff9-418f-8017-c9ef56d86182&ssp=smartadserver&expires=30&user_group=5&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=
Request Chain 855
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
Request Chain 858
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=zcBsF19LTUhQb0J2ZFduR0tJWlp1Z24wJTJCRTRxM1ElMkZsVXVqMTNsTG4wbUN5UHpXJTJGSyUyQklZb3BLSCUyRjFwJTJGNnFvbjU3YWRjd3U3RTFPYkR4b0dqb0hZJTJCTDklMkZVUWRVWU53V2FoMEtRZzRXR0pkVDVTTVlRUzM3RjlyJTJCVjhRbE14dHkxRWp1c2duQmVoZFM5WVlROGEyanl3QklUaEElM0QlM0Q&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=NtS0h3w2NGliaFYyalpXWEI4TEFxVGRBR1RGL2x4YTg3eHc4SGNVTnUrQTNqSzdFejVubVMwbVQ3aEtPZklJSG5pcTB6dzdoSDc1QUxiQTQ3RG1jWkI0NkNIemxvditFRm8vTjdsQzdMYmVYbUJNeTdvakh2MWdiaGV0MXlsZCtMeUdYSlNhL29yRkVzTGNZbE9BRURZc2poMUJVK25pQkIvbUVNb2hsTTJ3R205VUR3cWdkUTJucEhmamxObnRnM3V3ZGtZeS9ZTDlrWlgwMjQ1VlVsQlBUSUVSNHNUVWtHNnhhZ1A1UldqOXRGdkpjNkduS3ZmeUdabEJEM05odDF2RUFUU2Q3R0liUjN6SHpmMVFCNm1ZRmtyYUI5MGR1MWhrZnI2eXN3N2FibnhDST18&cppv=2
Request Chain 860
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=zcBsF19LTUhQb0J2ZFduR0tJWlp1Z24wJTJCRTRxM1ElMkZsVXVqMTNsTG4wbUN5UHpXJTJGSyUyQklZb3BLSCUyRjFwJTJGNnFvbjU3YWRjd3U3RTFPYkR4b0dqb0hZJTJCTDklMkZVUWRVWU53V2FoMEtRZzRXR0pkVDVTTVlRUzM3RjlyJTJCVjhRbE14dHkxRWp1c2duQmVoZFM5WVlROGEyanl3QklUaEElM0QlM0Q&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=jdlKbnxZeGplWHJ0Ty9FYTBzem9KOC9oMkx1ZGh5eVhxTHhVYk91MkZCOXdLK3MySTdaUC9EbExmRGNPMkVVaGFjRXNOTm4yQzZZYXFNWDZLaHVJZ2VKbExKR1lTVlU1UFpVVllHYmRaQnd1OFUrTFJTakJqRHNiTHZ2WmJSam40MzNlMmJZWXhSYytnUG5wRFFhb3dWTmpwWGhtci91elI3OHNpczM3TnYyK2syU2VpOVFQa2V0Yno2WkVURkVCUjBvSFF5THV2UWlrSGgwMU4wZkdjdzN6RjVrMnRmK0ttUFJOT3Qzd0xvWWRhS3YrbmNaeDlObjMzOHpGRnoyY1YzL0toS0ZxYXExL2VqeVB6SUFiTSt0SFQyVzRVTFBzZXNpZHd4emYvdVVKenhEcz18&cppv=2
Request Chain 869
  • https://sb.scorecardresearch.com/c2/6035443/cs.js HTTP 302
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
Request Chain 879
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:8E87CD5E-E863-49F4-8101-49E63E3D4BD9 HTTP 302
  • https://io.narrative.io/?io.narrative.guid.v2=d68568d0-0fa2-11ee-b479-0e71178f036d&companyId=673&id=pubmatic_id:8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Request Chain 880
  • https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=ZzI3RE5ydUpjVC1TdnFMd0cxTmpFZy15UQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%253D%253D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/a?adform_uid=1598040676591792150&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D HTTP 302
  • https://a.audrte.com/p
Request Chain 884
  • https://pixel.onaudience.com/?partner=214&mapped=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent= HTTP 302
  • https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0 HTTP 302
  • https://pixel.onaudience.com/?partner=161&icm&cver&mapped=ccefd08a7a2dee4d7fe9c6bf481a14a8&gdpr=0 HTTP 302
  • https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/tpid=d2a6ca27ac73d20d/gdpr=0/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%24%7Bgdpr%7D HTTP 302
  • https://pixel.onaudience.com/?partner=104&icm&cver&mapped=a433a0635e30a7fd76ec22a26382a12&gdpr=0 HTTP 302
  • https://pixel.onaudience.com/?partner=109&icm&cver&gdpr=0&smartmap=1&redirect=tags.bluekai.com%2Fsite%2F33141%3F%26id%3D%25m HTTP 302
  • https://tags.bluekai.com/site/33141?&id=1327fde4d7fe8871 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
Request Chain 891
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Request Chain 894
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Request Chain 895
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Request Chain 896
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/973f48b68d39913ead7b63a7ed88bc5?gdpr_consent=&gdpr=0
Request Chain 901
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 902
  • https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1598040676591792150&gdpr=0&gdpr_consent=
Request Chain 903
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
Request Chain 904
  • https://a.audrte.com/get?p=M501991648&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D141%26partneruserid%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=141&partneruserid=g27DNruJcT-SvqLwG1NjEg-yQ&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fa.audrte.com%2Fmatch%3Fuid%3DSMART_USER_ID%26p%3DM501991648%26r%3Dhttps%253A%252F%252Fa.audrte.com%252Fp%253F HTTP 302
  • https://a.audrte.com/match?uid=4614819635623485669&p=M501991648&r=https%3A%2F%2Fa.audrte.com%2Fp%3F&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/p
Request Chain 906
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Request Chain 907
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%26f%3Di%26uid%3D%24UID HTTP 302
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
Request Chain 911
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid] HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
Request Chain 913
  • https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
Request Chain 915
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
Request Chain 918
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Request Chain 920
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Request Chain 921
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Request Chain 922
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/da3024658895bd5e79dc0b645ffc08?gdpr_consent=&gdpr=0
Request Chain 923
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Request Chain 925
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%26f%3Di%26uid%3D%24UID HTTP 302
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
Request Chain 928
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dadform%26dataid%3Ddata4%26uuid%3D%24UID HTTP 303
  • https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
Request Chain 929
  • https://x.bidswitch.net/sync?ssp=rtaplus&user_id=VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy&gdpr=0 HTTP 302
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=b906d225-1d58-4500-8893-66f3b5de01e6&ssp=rtaplus&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=419&user_id=10599714307805270596&ssp=rtaplus&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Request Chain 930
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dsovrn%26dataid%3Ddata12%26uuid%3D%24UID HTTP 307
  • https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
Request Chain 932
  • https://creativecdn.com/cm-notify?pi=connectad HTTP 302
  • https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
Request Chain 934
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid] HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
Request Chain 936
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZJIBgknqWgpSPnqrMo17egAADtAAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
Request Chain 937
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=c0d66492-0183-4f00-930f-e67415c7188d
Request Chain 938
  • https://match.prod.bidr.io/cookie-sync/ie HTTP 303
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAD8LE7JJAMAAB-Q-u4sFQ&expiration=1688499856
Request Chain 939
  • https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID HTTP 302
  • https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=1179662177681492769
Request Chain 940
  • https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
  • https://stags.bluekai.com/site/23178?id=7dYANMJyrp6NSRwK_hfM&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3SOVWT6Y3NL5SHG4C7NFSD2MJXEZSXQY3IMFXGOZJ5NFXGIZLYEZSXQ5DFOJXGC3C7OVZWK4S7NFSD2N3ELFAU4TKKPFZHANSOKNJHOS27NBTE2 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3SOVWT6Y3NL5SHG4C7NFSD2MJXEZSXQY3IMFXGOZJ5NFXGIZLYEZSXQ5DFOJXGC3C7OVZWK4S7NFSD2N3ELFAU4TKKPFZHANSOKNJHOS27NBTE2 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=7dYANMJyrp6NSRwK_hfM
Request Chain 941
  • https://x.bidswitch.net/sync?ssp=index HTTP 302
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dindex HTTP 307
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dindex HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=620af48c-687b-4acd-b194-f908d727b4e1&ssp=index HTTP 302
  • https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
Request Chain 942
  • https://ad.turn.com/r/cs?pid=21 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8301830339311477822
Request Chain 945
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJIBgwATV5hRfwBa
Request Chain 948
  • https://match.adsrvr.org/track/cmf/openx?oxid=3c89572f-d6b6-753f-dfa0-46c780762e48&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NTlmMTdjMDYtYzVkMi00YjFlLTg5YWEtM2Q2NGZmMDkxMDIy&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022 HTTP 302
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&google_gid=CAESEPmdpgORtQ_COK5_UXRIfeE&google_cver=1 HTTP 302
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022 HTTP 302
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=1179662177681492769&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022 HTTP 302
  • https://tags.bluekai.com/site/5386?id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
Request Chain 950
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEN4T7m2w3pvZfNlg8evq3kE&google_cver=1
Request Chain 951
  • https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
Request Chain 954
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
Request Chain 965
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=FjHRA3xFcUY4VGNwT1ZTNC84K0JRRXlNSVpTZDhGZG1vUktWZ0lNSEpwQkFZd09rMHlwOW1BZU5Pb0IvMnBETVRGMk1ySEFWOGRTZVNZcFhleis1eUZNd3RtblYzbEVjbUhTQTBsNUF6V2tpdVZOc2hTMnRpTmNrM05TMlEwWVVKbWM0UTdOb2hmZUN3STJDL2dFWFhPR09IaUttWlFwVklxUmY0R3A4N3R5c3loUi9jN1Y4Y2x6Z08rWmYwUzRNWHN5QXZWbHRSWElHbHRNVEtBbU9uZUhFcXluVFFoSGYvanhlVXVPZU9XWFJ5MVJObDlud0EzUFo4SjdKUHJiOXp2WVBDZ1RUSU5aUVNoR0N6OUZCdkc4NTczeUkxaVFMUURaVWlhK21Yb0JHL3kwMD18&cppv=2
Request Chain 968
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=iec2lHxTNnROeFhDcTNveWloNzZQZGNMb2NvLzlPMEtxNXJreXB1eVZGbnBQVW8zVC9tZndpejlTSHliS2xXa2ZuQTJCYWxzOStEMXY0UEZ3TVk0NTZ5aGRhOXZIYkUxOHYzOHV2QUxrN0VxZm44RjB3dGxGSnE5UzJ3OW81VFlSSWZDMStUY3B1b1NJWG9WbUtJVlhzSjY5VzVIaG5nVnEzeG1LQWwxem1RaytJZ3FUTEV3T2ZZY2NhS205NjltQ0VIMWtDTXpDakU2RUZJVzlDekNlRTc0WEdQRzI4T2RSbDlxcDVtUDF1N0JGb00xNEtoUG9PM2JiL0pDZVJiNE4zSzFXbDdOSGZ1RTl5YTB0b0tiV0xDcXRFTU8rNXFJNUx5RWdwaXgvUko5TWVoVT18&cppv=2
Request Chain 969
  • https://creativecdn.com/cm-notify?pi=connectad HTTP 302
  • https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
Request Chain 971
  • https://x.bidswitch.net/sync?ssp=rtaplus&user_id=VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy&gdpr=0 HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=46&redir=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D80%26user_id%3D%5BUUID%5D%26expires%3D30%26ssp%3Drtaplus%26bsw_param%3Db906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=80&user_id=c0d66492-0183-4f00-930f-e67415c7188d&expires=30&ssp=rtaplus&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Request Chain 972
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dadform%26dataid%3Ddata4%26uuid%3D%24UID HTTP 303
  • https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
Request Chain 974
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dsovrn%26dataid%3Ddata12%26uuid%3D%24UID HTTP 307
  • https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
Request Chain 976
  • https://ad.turn.com/r/cs?pid=21 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8301830339311477822
Request Chain 977
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZJIBgknqWgpSPnqrMo17egAADtAAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
Request Chain 978
  • https://match.prod.bidr.io/cookie-sync/ie HTTP 303
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAD8LE7JJAMAAB-Q-u4sFQ&expiration=1688499856
Request Chain 979
  • https://p.rfihub.com/cm?in=1&pub=2079 HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=968062838393799511
Request Chain 980
  • https://x.bidswitch.net/sync?ssp=index HTTP 302
  • https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=index&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=413&ssp=index&user_id=csonata_027c9f7f-9cca-4583-8476-8ba6a3d62fc9&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6&expires=10&gdpr=&gdpr_consent=&gdpr_pd= HTTP 302
  • https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
Request Chain 981
  • https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=dd8be30d-cfe6-0402-a26c293a
Request Chain 982
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=c0d66492-0183-4f00-930f-e67415c7188d
Request Chain 985
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072977&val=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
Request Chain 988
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D HTTP 302
  • https://id.rlcdn.com/464246.gif?partner_uid=694f2849-1bf1-435f-80d9-c634b9ed4f90 HTTP 307
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=694f2849-1bf1-435f-80d9-c634b9ed4f90
Request Chain 989
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=1179662177681492769
Request Chain 990
  • https://ad.turn.com/r/cs?pid=9&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=8301830339311477822&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 995
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=P_MnunxxMStjcVluakp5NG5EYW1BNGUzWHZUZExQZjFmS0RzN0FHaXhGdDBTTXV4VGlwYkhxaDhjbXY5OFBreFVhcHo0NUM2NWNpQzd6bEdzNHRCbzlZR2p4SFJjWnJOczBYSTVJMVh3a3lOZnUyQVNKdGlhOWpUN0tSWVgvek5TVW1JUm4rVWVVbmFxb1k2ZGY5cS9FMXVHWUg2NHRxWW83SFEvTXJnZFFCSVFoa3dnQWtKT3JxZVpBS0t5cUlienVBd2IzWFVhUVU2WE5BV2xTNWNjZDduUkV0V3BUT2tseEJ1Z3NzNTkxVmcxTWdDQ2FCL2NCRU8wODVjbWs5NTFMQjVtL21vVmQ5WWVUT3dwMzdRUmNIL2JEZS8xK1BiRUhHQlF4M3pnRDlydkxlTT18&cppv=2
Request Chain 996
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=DZ6T03wwdHYyRUx3U29jWkJjS2hPMHZoWGMzZUh0UXpzOE05UHNoSUw4NUpDZlU0NHZCaG1INnpMU3VtREhHN2kxUVZYMFhIbFYycnF2NlF3Nmx1a2FHdllUU21SblEzOWNhUXduWTcwU281eGlwZVM4SmRYMkpJQSsxYWJPVGUrOWZDRlFibnp1dGdyWkplUXpUNzBBaVFQcFZralZvajVoNnBndVB2UXFtWjNaQ2hQRWFsYXUvb213T2k0Z0V3ZEJJY3JLd1NxcS81M01xVC81YTVlSjl2ZkVBMnliVnYxVEF3dTJjcHR3VTJaVUlaUzNUdmhiTVNpV1gxQUpzWDR4QUY2T2hFeXRRa0tUVjN2T1d5ZzEwWjVGOEQ2YWFLdVowUDI5NERoazl3OTJDQT18&cppv=2
Request Chain 997
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=lAphDXxvYkZnUGZmUEdFUnNSNVVtSGVsT0Npbm1VQ21nc3RKenhmdFdGaTBTYWxzc0JyUGRuRTZQU0ZkOFc4MUpjU2F0WTgrdk1GYWdUN0ZQcW8yZitFSG1wWmpkTEFaRXg0T24vUWpzbzErUFIxSkVZVjdSbzZZSzI1K3dMd2F0d0c3U2pmRHNNMTRuOEgrL3NLNnNjZkNCdXIrQXBRU1FidTBoUjE3czI1SzVGWG4rRFdkVForcVZxaUdYQVVvUkFRZ2NoYmZBc1grVC9Zbkx2dk85aVlXWGNBOWQ3T2E2SS9TTTBNby95MDk5bVhVVlpFTlM3Vm9qUFhEbXhOZlE1ZThrSU5iQU8vTEk1Znpsd21JZXRhMVcwQ3doeFFrSCsxazBNa002dlArQUlmND18&cppv=2

994 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ 		215 KB
50 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx / WordPress VIP <https://wpvip.com>
Resource Hash
a800be47e589df526eee6a11643f60c0fbdb2f8d76428a4cd727a95be85959c6
Security Headers
Name Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
1085
cache-control
max-age=300, must-revalidate
content-encoding
gzip
content-length
49835
content-security-policy
default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:43:59 GMT
host-header
a9130478a60e5f9135f765b23f26593b
link
<https://www.mercurynews.com/wp-json/>; rel="https://api.w.org/" <https://www.mercurynews.com/wp-json/wp/v2/posts/9968021>; rel="alternate"; type="application/json" <https://wp.me/p7ShJJ-FP8x>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000;includeSubdomains
vary
Accept-Encoding
x-cache
hit
x-hacker
If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by
WordPress VIP <https://wpvip.com>
x-rq
yyz1 85 188 443
boldcoastal.css
www.mercurynews.com/wp-content/themes/assets/static/css/ 		416 KB
63 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/css/boldcoastal.css?ver=1686774969
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c6038de77c2fca2f75327c1e7ec4751a8d45cc3737395a2abe403ac6d8e98144
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a24b4-6808c"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
wp-emoji-release.min.js
www.mercurynews.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-includes/js/wp-emoji-release.min.js?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 22 May 2023 14:14:06 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"646b78ae-4904"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
htlbid.css
htlbid.com/v3/mercurynews.com/ 		3 KB
695 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://htlbid.com/v3/mercurynews.com/htlbid.css?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.60.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-60-24.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2f218961fc995f27f5868268ca3f765d4e7066eb6144139ce5b9eefe9b9ad443

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
br
via
1.1 66114286e54efb82c700272100713f2e.cloudfront.net (CloudFront)
last-modified
Mon, 05 Jun 2023 22:43:44 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C1
age
528
x-amz-server-side-encryption
AES256
etag
W/"d0ed30e2f703616022754e56fc09aa63"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
cache-control
max-age=600
x-amz-cf-id
FyyX7MDmnjoK5qG6FKDlrWKrVQKQ1viIFj6QVV7kg9m_RXxS5X8OYw==
style.css
www.mercurynews.com/wp-content/client-mu-plugins/src/Sitemap/includes/ 		880 B
392 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/client-mu-plugins/src/Sitemap/includes/style.css?m=1676299207g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c540cdeba4eb897beea1c93c6452269a4de7b86a2e670b5b0ad37f9bbfc78c53
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 13 Feb 2023 14:40:07 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"63ea4bc7-370"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
/
www.mercurynews.com/_static/ 		31 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0f27b15848fb3a09df5fa1ba8e2ae9a80ca73faca61455767cd28318fd3c2c6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz1 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
mng-digisubs.styles.css
www.mercurynews.com/wp-content/plugins/mng-digisubs/static/ 		14 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/mng-digisubs/static/mng-digisubs.styles.css?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
aff8084000d2c0e029860444700f6c44b5d0124101ae9f87a9bb7d6b574fe24e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a24b4-385c"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
/
www.mercurynews.com/_static/ 		848 B
433 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??/wp-content/plugins/site-plugins/site-bang/static/css/screen.min.css,/wp-content/client-mu-plugins/src/Ads/assets/css/mobile-adhesion-style.css?m=1676299207
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
af791f4ecfb200dd519a03dc1760721fd4fc36cd3ef9f0b5caf592f9a3d49b91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 13 Feb 2023 14:40:07 GMT
server
nginx
x-rq
yyz1 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
bootstrap-icons.min.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ 		56 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:43:59 GMT
x-content-type-options
nosniff
content-encoding
br
age
6091528
x-jsd-version
1.5.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
8819
x-served-by
cache-fra-eddf8230021-FRA, cache-yul12822-YUL
x-jsd-version-type
version
etag
W/"e199-MKfLdwDci4zij+cy307LMP/uJk4"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
css
fonts.googleapis.com/ 		4 KB
953 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
270fb1f5320e32a7e0b8af9d3102063d8eb8950f4feb0ce3bb6c00536c1daa60
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:06:16 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:43:59 GMT
/
www.mercurynews.com/_static/ 		109 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyNkN0KwjAMhV/ING74sxvxUaS03ai2TVlSx97eDhwoKniXk+R8nASnDIaSuCSYQxl8YrR9BG0hkmVk0eINGq6lGZ1LKvqkqtzgD+fd657KqCGPJCRzdivkdapY5uD4gxQLrLCrk6zNDZpWtVjDlLqPk7eDE0ahDJlYloQV9Dfn4pNBJuN1gEAD8Zv4etwv1PKTZ2PxnOOpOXTHttvu9u0DeIF9tg==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f42437392991256301d04a743ae9c380aae62faef9a5bb0d4dde967ae9681df9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 20 Jun 2023 17:00:52 GMT
server
nginx
x-rq
yyz1 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
htlbid.js
htlbid.com/v3/mercurynews.com/ 		404 KB
110 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.60.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-60-24.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0e8e9fab28b24199f9d2b90a2b0996495b9d68cbe71550e5c4780bbf7028296f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
br
via
1.1 66114286e54efb82c700272100713f2e.cloudfront.net (CloudFront)
last-modified
Mon, 05 Jun 2023 22:43:44 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C1
age
575
x-amz-server-side-encryption
AES256
etag
W/"19fe31e40e621db88498bc266f8f8880"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=600
x-amz-cf-id
6ZVmLl9il1BWt9WWRavBiRhr1w_yhujzf0EHhecxBFwG6KKJc-nlMw==
sso-tools.min.js
www.mercurynews.com/wp-content/client-mu-plugins/src/SSO/assets/js/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/client-mu-plugins/src/SSO/assets/js/sso-tools.min.js?m=1670967803g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
feb0e7f17014201ea9124f23e3f63965411385abf0103fc682595d0674087a0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"6398f1fb-1536"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 13:55:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
539325
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 13 Jun 2024 13:55:14 GMT
loader.min.js
www.mercurynews.com/wp-content/plugins/loader-wp/static/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 19:18:43 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a1293-3e4a"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
global.js
www.mercurynews.com/wp-content/plugins/bloom-for-publishers/lib/js/ 		14 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/bloom-for-publishers/lib/js/global.js?m=1670967803g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
041f41b6b98e101febe7d24b8d7fdd9fd696dabad0fbe296c978272491c2a791
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"6398f1fb-3985"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
js
maps.googleapis.com/maps/api/ 		188 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/js?key=AIzaSyDJUi9DGZnqI8YbyBueZXiiJjKzw9kGDlE&ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
adac5f0ac3cba09025628039e8467b22408fa62d59c8b9c1b5b7f4a412306741
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Accept-Language, Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
63735
x-xss-protection
0
auth0-spa-js.production.js
cdn.auth0.com/js/auth0-spa-js/1.13/ 		105 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.auth0.com/js/auth0-spa-js/1.13/auth0-spa-js.production.js?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2511:fc00:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
6AzkYKZDwDnSxmQe5SqIWFlWTPBMtbyI
content-encoding
gzip
via
1.1 6583236304db9b508d67c62740f04654.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 19:05:27 GMT
last-modified
Thu, 07 Jan 2021 14:32:49 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P6
age
2313
etag
W/"8bea9e0d733d097381a1b5eb8c40983d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=10800,public
x-amz-replication-status
FAILED
x-amz-cf-id
oMqGFCInivld6iiODjX_z5nyV7X5CWF76MTKR0iho0UbE9bbxp_qdQ==
client
accounts.google.com/gsi/ 		191 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/client?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:805::200d Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
99219826e932380f0b45b7b6a348011dfa189c7d178b2d963a68da9685bf9513
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-xOSwSV-VK2lvBmOrWRXFTg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-security-policy
script-src 'report-sample' 'nonce-xOSwSV-VK2lvBmOrWRXFTg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
application/javascript; charset=utf-8
cache-control
private, max-age=1800
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Tue, 20 Jun 2023 19:43:59 GMT
/
www.mercurynews.com/_static/ 		289 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f9e7478a7ceb5f02339cda0af1f0df3c8f3d108b1f9d5323b962017919ae555f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
pushly-sdk.min.js
cdn.p-n.io/ 		300 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-37.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b34b500b4fe4d4f0be72fcb5b7c582c472495b1498072d19a1aaac0dc2022195

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:34:59 GMT
content-encoding
gzip
via
1.1 81834769243dfd27a095a32cf5b86722.cloudfront.net (CloudFront)
last-modified
Sun, 18 Jun 2023 05:05:18 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C2
age
553
x-amz-server-side-encryption
AES256
etag
W/"eeaa47f53affa0eb6622b034cf68505a"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=900
x-amz-cf-id
1TfGVeBMLAzqCPsqHWW0SQxDpffOkj9XLHq-DmC4FZq_ZV0rcFxUuw==
dfm-pushly.min.js
www.mercurynews.com/wp-content/plugins/dfm-pushly/static/js/ 		160 B
205 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-pushly/static/js/dfm-pushly.min.js?m=1686770323g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 85 187 443
last-modified
Wed, 14 Jun 2023 19:18:43 GMT
server
nginx
etag
"648a1293-a0"
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
160
script.js
a869.mercurynews.com/ 		148 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/script.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
4a7cc3810e9012a315f69d1dc6a4089e5b1e8db39f1707d3dd4d22c67462bb51
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:36:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
478
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
44451
x-xss-protection
1; mode=block
last-modified
Tue, 20 Jun 2023 19:35:50 GMT
server
-
etag
01c56a5810516920801a6040449259ac
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=600
x-robots-tag
noindex, nofollow
x-amz-cf-id
KJKReTNGBE7-hFoW13hZ4lBPV5E0p6c3nqm512DVQFGv_O9dICBo-w==
expires
Tue, 20 Jun 2023 19:46:01 GMT
osano.js
cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/ 		351 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:2e00:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
ee004e19a65d9657ccfd05c3c15ed2a49fafecb011b8dc60c799da2fc606fdcf
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
br
via
1.1 3b0649a8bee506c1d7498462d39e6c44.cloudfront.net (CloudFront)
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
79886
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 08 Jun 2023 02:50:01 GMT
server
CloudFront
etag
"0b9c83f25e35cd08524597a129a269f9"
x-frame-options
SAMEORIGIN
vary
Origin
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=86400, s-maxage=86400, must-revalidate, proxy-revalidate, no-transform
x-amz-cf-id
K-gyrSbn29KIrtvZTYubctegM--U1L7fYiqb69kwixYKdwTqLJx6fA==
mg2nw.min.js
prodmg2.blob.core.windows.net/newsletterwidget/mngcep/ 		143 KB
144 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://prodmg2.blob.core.windows.net/newsletterwidget/mngcep/mg2nw.min.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.60.62.4 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
eabc0f4a5b76ceb76d11713e56e77dc230f3672c9df4c43a79089fa69b056033

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Tue, 20 Jun 2023 19:43:59 GMT
Last-Modified
Tue, 30 Aug 2022 11:57:42 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
qpxGb9QXImzRxhdRLqrrAA==
ETag
0x8DA8A7ED8105951
Content-Type
application/javascript
Access-Control-Allow-Origin
*
x-ms-request-id
b4a0b71f-c01e-0011-46af-a36d0a000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
Content-Length
146402
/
www.mercurynews.com/_static/ 		53 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??/wp-content/plugins/dfm-ad-mods/static/js/hhsl-check.min.js,/wp-content/plugins/mng-digisubs/static/mng-digisubs.articleShare.bundle.js?m=1686774964j
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0152a088a37330522c1458229707cbc27e42f802e1ba385d887b8a0069927618
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
mn-logo.svg
www.mercurynews.com/wp-content/uploads/2020/09/ 		12 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/uploads/2020/09/mn-logo.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 23 Sep 2020 17:38:16 GMT
server
nginx
x-rq
yyz1 80 130 443
etag
W/"497950346404e2d1"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=31536000
index.js
tags.remixd.com/player/v5/ 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-63.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:12 GMT
content-encoding
gzip
via
1.1 f91b1dd39ce8309d7fc575add365607e.cloudfront.net (CloudFront)
last-modified
Tue, 21 Jun 2022 15:31:59 GMT
server
AmazonS3
x-amz-cf-pop
EWR50-C1
age
49
etag
"57b6f8ad4125903b7e06bb427c232d10"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
public,max-age=1800
accept-ranges
bytes
content-length
10041
x-amz-cf-id
F6nrRQYx4zH2ihb7vhOKf2Pk8A9eObaULi9paHJpXzn1GpGcS_d7-g==
Trust-Logo-Horizontal.svg
www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/ 		7 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/Trust-Logo-Horizontal.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz1 85 187 443
etag
W/"6398f1fb-1ab8"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=31536000
banglogo_small.png
www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/banglogo_small.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
75e752bf99299219069a5af90f61408be1ab85af71df9aea097bc70e9075c122
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 85 187 443
last-modified
Tue, 13 Dec 2022 21:43:24 GMT
server
nginx
etag
"6398f1fc-3b7b"
x-cache
HIT
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
15227
/
www.mercurynews.com/_static/ 		105 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyVkd1SAyEMhV9INlr/9sbxWdglXVgDYRLQ2T69YO2FY+3YK5jkfMk5AB/ZzJwKpgKZ6hKSQkyL8YXAqmJRcEHLqWYiOx1iSMOqN3CGnYg5mj2LyXWioB5FIXObsB7Pq0BFK7Pv6PH2F5w9F077QATvmBwL5DCXKthLl+z+BskeNg0H/JEypJmqQ+1Ovp7jW9xamWnrfNOglP9Aggs2rS0tq9RUQsQrd12Ue+a3s18UqznF7rOsKNJm7ocRphrIAbF1KI16jS93T+Pzbrx9eNytn7f9zJs=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a41b806e591339f4357460a85a5c04b8f473f1c80ef3a1c3e3e14cf76f4471d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 20 Jun 2023 17:00:52 GMT
server
nginx
x-rq
yyz1 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
p.js
cdn.parsely.com/keys/mercurynews.com/ 		56 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.parsely.com/keys/mercurynews.com/p.js?ver=3.8.4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.101.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-101-60.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
cdd102d71e33401eb5ebadb19f1732edafa44df8800da6d33f29329c3ed9baef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Tue, 20 Jun 2023 13:52:05 GMT
content-encoding
gzip
via
1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
last-modified
Thu, 09 Dec 2021 15:22:33 GMT
server
nginx
x-amz-cf-pop
JFK50-P5
age
21120
etag
W/"61b21f39-df44"
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400, public
x-amz-cf-id
Qqh1qd1avEvXHC_wwTpRQptuf1LMB1JX8H7GKSLY6tjCZ1-QpXq1_w==
expires
Wed, 21 Jun 2023 13:51:59 GMT
ads.js
www.mercurynews.com/wp-content/themes/wp-mason/static/js/ 		87 B
155 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/wp-mason/static/js/ads.js?ver=1.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 85 187 443
last-modified
Tue, 13 Dec 2022 21:43:24 GMT
server
nginx
etag
"6398f1fc-57"
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
87
/
www.mercurynews.com/_static/ 		112 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJydzkEKwjAQQNELmQ5KSXUhniUmaZuamQnOVPH2BnShIGLdfnjw4VqMZ9JICjpGjAJOJKqAqNPkYRLwjMjU+HGmU4OJmklW8IMrnG99ylmWoCPn4NnVkL+wWtAJ0wvMPLBJOBinev5ES56HRAKhR+OCQQ7yxmt73CzHsqFLCpH/kIW1Xj/hAfdru7Vd1+5sO90BHsOYcw==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ba5a6577ef04a324ae8a4af890e1e26d341ac85bc5c49ad9be1678a61fcc3168
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
index.js
cdn.viafoura.net/entry/ 		34 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.viafoura.net/entry/index.js?ver=2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:7800:8:2ae1:d740:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
47837a16e7b231cca39151ae124c3cb8ad0fb875a78fb39ef15725f9bd7a8870

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
7clcVwJ2uZ2xninCT38x2KDy2PpKpuXM
content-encoding
br
via
1.1 aa7679f2d01b23d9a66bfa6e92991b04.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 19:34:07 GMT
x-amz-cf-pop
EWR53-C2
age
594
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 14 Jun 2023 17:25:59 GMT
server
AmazonS3
etag
W/"738c5427d8f7c25ccede619b95ab7ac5"
vary
Accept-Encoding
content-type
text/javascript
cache-control
public,max-age=600,s-max-age=60
x-amz-cf-id
wIbeSJEp_-5W6C7MQSH_WbKIoaPrlwA_tzWDKzd8-zlILCzLXwWWOg==
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		77 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js?ver=2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9f3266b12e76f135c13f4faedb2f87832433f7125b9c41d5f73f6182be47a189
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26343
x-xss-protection
0
server
cafe
etag
284 / 19528 / m202306140101 / config-hash: 16396063179614486054
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:43:59 GMT
dfm-viafoura.main.bundle.js
www.mercurynews.com/wp-content/plugins/dfm-viafoura-prototype/static/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-viafoura-prototype/static/dfm-viafoura.main.bundle.js?m=1678993769g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
820bbf383e1e212ca7bd59f29af6ab490ea9da86e84d61ed3322b9c77ac2fc6c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Thu, 16 Mar 2023 19:09:29 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"64136969-603c"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
e-202325.js
stats.wp.com/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202325.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz
date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
br
last-modified
Fri, 19 May 2023 02:58:21 GMT
server
nginx
etag
W/"6466e5cd-3508"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Wed, 12 Jun 2024 13:30:21 GMT
sharing.min.js
www.mercurynews.com/wp-content/mu-plugins/jetpack-12.2/_inc/build/sharedaddy/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/mu-plugins/jetpack-12.2/_inc/build/sharedaddy/sharing.min.js?m=1687280452g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 20 Jun 2023 17:00:52 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"6491db44-2259"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
css
fonts.googleapis.com/ 		9 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a63284d0b07236a49f89dd197f9aa2ea595e314e750b5d42834fbda2f7cba411
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:22:19 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:43:59 GMT
ai.0.js
az416426.vo.msecnd.net/scripts/a/ 		94 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/79DC) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
1075
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (nya/79DC)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c079a44a-b01e-00b5-74ad-a369c5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Tue, 20 Jun 2023 20:14:00 GMT
polyfill.min.js
polyfill.io/v3/ 		101 B
669 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polyfill.io/v3/polyfill.min.js?flags=gated&features=es5%2CCustomEvent%2CArray.from%2CArray.isArray%2CArray.prototype.filter%2CArray.prototype.find%2CArray.prototype.findIndex%2CArray.prototype.forEach%2CArray.prototype.indexOf%2CArray.prototype.keys%2CArray.prototype.lastIndexOf%2CArray.prototype.map%2CArray.prototype.reduce%2CDate.prototype.toISOString%2CDocumentFragment%2CDocumentFragment.prototype.append%2CDocumentFragment.prototype.prepend%2CElement%2CElement.prototype.after%2CElement.prototype.append%2CElement.prototype.before%2CElement.prototype.classList%2CElement.prototype.cloneNode%2CElement.prototype.closest%2CElement.prototype.dataset%2CElement.prototype.matches%2CElement.prototype.placeholder%2CElement.prototype.prepend%2CElement.prototype.remove%2CElement.prototype.replaceWith%2CElement.prototype.toggleAttribute%2CEvent%2CJSON%2CMap%2CNumber.parseInt%2CNumber.parseFloat%2CObject.assign%2CObject.create%2CObject.defineProperties%2CObject.defineProperty%2CObject.entries%2CObject.getOwnPropertyDescriptor%2CObject.getOwnPropertyNames%2CObject.is%2CObject.keys%2CObject.values%2CPromise%2CPromise.prototype.finally%2CSet%2CString.prototype.trim%2CXMLHttpRequest%2Cdocument.getElementsByClassName%2Cdocument.currentScript%2Cdocument.querySelector%2Cfetch%2CgetComputedStyle%2ClocalStorage%2CArray.prototype.some%2CDate.now%2CEvent.focusin%2CEventSource%2CFunction.prototype.bind%2CFunction.prototype.name%2CHTMLDocument%2CNodeList.prototype.forEach%2CNodeList.prototype.%40%40iterator%2CNode.prototype.contains%2CObject.getPrototypeOf%2CObject.setPrototypeOf%2CRegExp.prototype.flags%2CString.prototype.%40%40iterator%2CString.prototype.startsWith%2Cconsole%2Cconsole.debug%2Cconsole.error%2Cconsole.info%2Cconsole.log%2Cdocument%2Cdocument.head%2Cdocument.visibilityState%2Clocation.origin%2CrequestIdleCallback%2Cscreen.orientation%2CmatchMedia%2CURL
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::282 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 20 Jun 2023 19:43:59 GMT
age
1238859
detected-user-agent
Chrome/114.0.0
useragent_normaliser
chrome/114.0.0
server-timing
HIT, fastly;desc="Edge time";dur=1
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
113
referrer-policy
origin-when-cross-origin
last-modified
Wed, 03 May 2023 00:17:37 GMT
fastly_service_version
195
vary
User-Agent, Accept-Encoding
access-control-allow-methods
GET,HEAD,OPTIONS
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
normalized-user-agent
chrome/114.0.0
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
gen_204
maps.googleapis.com/maps/api/mapsjs/ 		3 B
45 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDJUi9DGZnqI8YbyBueZXiiJjKzw9kGDlE&ver=6.2.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23
x-xss-protection
0
session
session.mercurynews.com/api/ 		93 B
256 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.223.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-223-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:43:59 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 		16 B
700 B 		Script
General
Check archive.org
Download Go to
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json822
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.200.130.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-200-130-143.compute-1.amazonaws.com
Software
- /
Resource Hash
6ff6e32d32130de1c69ebdd3aaa16e3cbb97b13329af55c3d66ff98aafd635b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
36
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
session
session.mercurynews.com/api/ 		93 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.223.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-223-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:43:59 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
bdbb122c-47fb-497f-aa05-a166773304f4
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/bdbb122c-47fb-497f-aa05-a166773304f4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 		16 B
701 B 		Script
General
Check archive.org
Download Go to
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json823
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.200.130.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-200-130-143.compute-1.amazonaws.com
Software
- /
Resource Hash
602fa5427a46cf590fddda3739e9bd055ef29862c67170a4cf18199108a6b4ad
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
36
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
web-vitals.iife.js
unpkg.com/web-vitals@3.3.2/dist/
Redirect Chain
  • https://unpkg.com/web-vitals@3/dist/web-vitals.iife.js
  • https://unpkg.com/web-vitals@3.3.2/dist/web-vitals.iife.js
7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/web-vitals@3.3.2/dist/web-vitals.iife.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
27e29a5aebbbc2d82b6f7d9dbbf03ced7ecaf592adf68338a02aff332b3e7bd5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
688678
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01H2RMJY0R3RHJ9DJ5TSRCZ0FZ-yul
server
cloudflare
etag
W/"1b99-+0VwSXVmoLd0uGhBB2XoSfehK74"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7da681008ac833ff-YUL

Redirect headers

date
Tue, 20 Jun 2023 19:43:59 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01H3D4XPTYC32E967626N2JGH7-yul
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
458
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
location
/web-vitals@3.3.2/dist/web-vitals.iife.js
cache-control
public, s-maxage=600, max-age=60
cf-ray
7da680ffb94533ff-YUL
loader.js
cdn.taboola.com/libtrc/medianewsgroup-network/ 		505 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/medianewsgroup-network/loader.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6020e58617f93875554a133f107b287c97dd12c8d8b6c0eb3f46f2d04a722be4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
GfG4Ne0IZxvonN2uPJ49lY63yw5v1noD
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:00 GMT
x-amz-request-id
5FMK29AW52P9MJ8T
age
45
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
FAILED
content-length
53269
x-amz-id-2
/H8wYheOFqLvgtz3/JaDjrbMvXnaSJP+MED7CGZpwNOaPvS8bQkkJFcXjBwCgQ+8bn9H5vXw7HU=
x-served-by
cache-yyz4535-YYZ
last-modified
Tue, 20 Jun 2023 09:48:47 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290240.082754,VS0,VE7
etag
"ab1d787c5482a21bc61f4a1ca8a5e5ec"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
96
access-control-allow-origin
*
cache-control
private,max-age=14401
accept-ranges
bytes
x-cache-hits
1
gtm.js
www.googletagmanager.com/ 		499 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
98d7545780ac424b4a059f21f71f5efc95a7fb9fc716c882ab6012a18ed397e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
119377
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:44:00 GMT
truncated
/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141

Request headers

Referer
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
font/truetype
SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
fonts.gstatic.com/s/droidsans/v18/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidsans/v18/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 15:10:10 GMT
x-content-type-options
nosniff
age
275630
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
22376
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:25:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 15:10:10 GMT
bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/ 		88 KB
89 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:43:59 GMT
x-content-type-options
nosniff
age
8405051
x-jsd-version
1.5.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
90528
x-served-by
cache-fra-eddf8230031-FRA, cache-yul12831-YUL
x-jsd-version-type
version
etag
W/"161a0-RkmHeGigBozlCxBdDSojXoAQyY8"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
fonts.gstatic.com/s/droidsans/v18/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidsans/v18/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 15:05:16 GMT
x-content-type-options
nosniff
age
275924
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21224
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:04:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 15:05:16 GMT
tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
fonts.gstatic.com/s/droidserif/v19/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidserif/v19/tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa898d9bdc34304905c4b165e561c8dc3fe452b0bdd7259140e1aa530a42136
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 20:49:48 GMT
x-content-type-options
nosniff
age
341652
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
25980
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:47:46 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 15 Jun 2024 20:49:48 GMT
tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
fonts.gstatic.com/s/droidserif/v19/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidserif/v19/tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aee4051a20e975b9bb6fdc20984a091eb1f55c35ea87abe441db4cdbe8c116d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 00:08:38 GMT
x-content-type-options
nosniff
age
329722
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
22476
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:19:08 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 00:08:38 GMT
session
session.mercurynews.com/api/ 		93 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.223.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-223-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:00 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
/
p1.parsely.com/plogger/ 		43 B
258 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p1.parsely.com/plogger/?rand=1687290240162&plid=74757395&idsite=mercurynews.com&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&sref=&sts=1687290240153&slts=0&title=Meghan+Markle+earned+more+than+The+Weeknd+for+%2712+hours+work%27%3A+Spotify&date=Tue+Jun+20+2023+19%3A44%3A00+GMT%2B0000+(GMT)&action=pageview&pvid=6121356&u=pid%3D5f712203e2372b307f5c6c6ccb85d754
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.144.144.142 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-144-144-142.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:00 GMT
Cache-Control
no-cache
Last-Modified
Tuesday, 20-Jun-2023 19:44:00 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
style
accounts.google.com/gsi/ 		533 B
609 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/style
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:805::200d Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-0gyK6z6XMUsMEXPwYsCJMw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-security-policy
script-src 'report-sample' 'nonce-0gyK6z6XMUsMEXPwYsCJMw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
text/css; charset=utf-8
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Tue, 20 Jun 2023 19:44:00 GMT
status
accounts.google.com/gsi/ 		40 B
530 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/status?client_id=682906792919-57292pukl717kpesjb0r4cnr5342j506.apps.googleusercontent.com&as=5Foo5l6NaP3ek1Gk45haZQ
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:805::200d Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
46491fce827ad4aadc653b93c42c9bf516b3e0cc3a231ba9574518f14a993a6d
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-Hqs4BRLtUVKnXMYSpPJSpQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-Hqs4BRLtUVKnXMYSpPJSpQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
x-content-type-options
nosniff
content-encoding
gzip
content-disposition
attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
server
ESF
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Mon, 01 Jan 1990 00:00:00 GMT
Britain_Royals_03732-1.jpg
www.mercurynews.com/wp-content/uploads/2023/03/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/uploads/2023/03/Britain_Royals_03732-1.jpg?w=862
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d563298c3ede28f01a71384931c619cda9aadce1007034f284f3c0f0316303f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 87 131 443
last-modified
Tue, 20 Jun 2023 19:44:00 GMT
server
nginx
etag
"b97b696761f2751a"
vary
Accept
x-cache
MISS
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
content-length
31734
common.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/ 		42 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/common.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cbccc935557398179deeef044a5ab2353e97ca4961f313793c8ba03964c43e93
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a24b4-a619"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
common-async.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/ 		64 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/common-async.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a832c721859e66024092445300431d52b19ce96eb53588ad13954e78be2a8580
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 187 443
etag
W/"648a24b4-10029"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
boldcoastal-async.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/boldcoastal-async.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4d04e98fa76e2cdba4b0b45b0b206b13de39ff72f6371b7d97ed515e21646722
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz1 85 188 443
etag
W/"648a24b4-c75"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
mercurynews.com
pubcast-files.remixd.com/player-configs/ 		8 KB
9 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pubcast-files.remixd.com/player-configs/mercurynews.com
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
f9d24c71e954513157a412b5339112437e013cf99070b258e445101f16747500

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:15:52 GMT
age
1688
x-guploader-uploadid
ADPycdtl3b7W3ZYcxg15tBpa9tFqwCBBd1qHhrqhg0HW4vjn2AiS7tCxyjUZQZt-bgW0wLaGuntqfXm2-7jX3_fh6vJ85bqBnytt
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8352
last-modified
Thu, 15 Jun 2023 11:20:10 GMT
server
UploadServer
etag
"50de11d656548e115c3b3202413c53f2"
x-goog-generation
1686828010228687
x-goog-hash
crc32c=wwSIAQ==, md5=UN4R1lZUjhFcOzICQTxT8g==
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600
x-goog-meta-cache-control
public, no-cache, must-revalidate
x-goog-stored-content-length
8352
accept-ranges
bytes
content-type
application/json
expires
Tue, 20 Jun 2023 20:15:52 GMT
821
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		160 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A00%2B00%3A00&ts=1687290240282
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
5d718b0fd040ff84f5e45af823f082efe2dcefc5aa392da7596e41bf3e25beca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
159
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
q5ZWkO8Wfd9ZAtnE48GGocjmSuWPYN_ndGkLFslIod95yTh-OznDMw==
expires
Thu, 01 Jan 1970 00:00:00 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		77 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
588ca57d95e8baf84218a1155de25c911c9a88308083f27f47c41cbb0b818b16
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26343
x-xss-protection
0
server
cafe
etag
864 / 19528 / m202306140101 / config-hash: 16396063179614486054
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:00 GMT
apstag.js
c.amazon-adsystem.com/aax2/ 		236 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-107-138.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:16:24 GMT
content-encoding
gzip
via
1.1 613faec4b883bfe2ebdd8a74d5006f4c.cloudfront.net (CloudFront), 1.1 c824f42276c55792245504036b5383fa.cloudfront.net (CloudFront)
last-modified
Thu, 15 Jun 2023 18:14:55 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-C3, JFK50-P3
age
1657
x-amz-server-side-encryption
AES256
etag
W/"7c6a36eb4b73f6b7cf4a63a33418a2c9"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=3600
x-amz-cf-id
zQlUSVzhokKsf87tOgD0q3pb1LBngJLsePmSx5KqyUpeE57HRo-5DQ==
821
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		143 KB
22 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A00%2B00%3A00&ts=1687290240340
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
6c591551bbf2ca5f1f6edb27d23644c42abc00a5f041b29d837bb4c1206fe078
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
21390
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
yUj8-g2_hciGZDXiXFRjQLXaSkjrf_VPX-PlMWWTOPvMe1LzXk3tUA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
session
session.mercurynews.com/api/ 		93 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.223.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-223-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:00 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
loader-config.json
loader-cdn.azureedge.net/prod/dfm/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://loader-cdn.azureedge.net/prod/dfm/loader-config.json?_=1687290239377
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C73) /
Resource Hash
5ce0cb7f558c1aca9c6e94c7d85d76db859218132923c039b7ef7b38a29f8dfd

Request headers

Accept
*/*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
content-md5
1iDtMuqZEAqLGRPxG2wEug==
age
43051
x-cache
HIT
content-length
1300
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:44:01 GMT
server
ECAcc (nya/1C73)
etag
0x8DB6B18C9F2D8E6
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
7b9ac8bb-001e-0088-404b-a312b7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
e982513f-dade-4167-a8ab-deefa9bdb382
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/e982513f-dade-4167-a8ab-deefa9bdb382
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
f8c6588f-7a18-4e08-8f64-0b226a888b65
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/f8c6588f-7a18-4e08-8f64-0b226a888b65
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
impl.20230620-6-RELEASE.js
cdn.taboola.com/libtrc/ 		771 KB
161 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/impl.20230620-6-RELEASE.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3-br /
Resource Hash
3d7a16ff1ffd8d8507acd6f1ac3f27609a4e979b0a8e37474d3e0ba43e20fe3c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
Lg6X9ZxEl16yvG.szvkf_1XLvOmekw9F
content-encoding
br
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:00 GMT
x-amz-request-id
6QG025JR7T55R2JW
age
8391
x-amz-server-side-encryption
AES256
x-cache
HIT
content-length
163991
x-amz-id-2
lwbzVQRMkwSqoSsfWr3jxgc9AkvzWXf4ID9C5NVpS5I8567AgNlZIPvzRAA7oUaqmxmUuPI2vKQ=
x-served-by
cache-yyz4535-YYZ
last-modified
Tue, 20 Jun 2023 09:24:09 GMT
server
AmazonS3-br
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290240.416523,VS0,VE0
etag
"fd6dea8d7a047382b08a9c2a433a2c8f"
vary
Accept-Encoding
content-type
application/javascript
abp
72
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
5766
/
cmp.osano.com/ Frame 57D2 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:2e00:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45266
content-encoding
br
content-type
text/html
date
Tue, 20 Jun 2023 07:09:35 GMT
etag
W/"287b497c992487af362d33204f87d28f"
last-modified
Thu, 21 Oct 2021 22:01:08 GMT
referrer-policy
strict-origin-when-cross-origin
server
AmazonS3
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding Origin
via
1.1 3b0649a8bee506c1d7498462d39e6c44.cloudfront.net (CloudFront)
x-amz-cf-id
pnLsrS2uZ0D9Fko6T0tNOH8OH7Fh5fPhBrU_EcdyhHiqPiOp_HBsUQ==
x-amz-cf-pop
JFK50-P5
x-amz-version-id
xT1PkIFehetvNf5lINcU02FbT3u47kBr
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-xss-protection
1; mode=block
v2
api.viafoura.co/v2/www.mercurynews.com/bootstrap/ 		7 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.viafoura.co/v2/www.mercurynews.com/bootstrap/v2
Requested by
Host: cdn.viafoura.net
URL: https://cdn.viafoura.net/entry/index.js?ver=2.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:44f0:4850:e869:190e:35cd:331e Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
0e5ee8b14fb0279a76775e20872eab39e19ccbb0754e5692415ba900739155db

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-instance-id
i-0dda0caab69ff79e8
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS, PUT, DELETE, PATCH, HEAD
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
max-age=0
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
expires
Tue, 20 Jun 2023 19:44:00 GMT
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/ 		408 KB
126 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5b70d8eb19ca32d244e29e759e816c343be893232978532c9d5943f838e60e0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 06:48:24 GMT
content-encoding
br
x-content-type-options
nosniff
age
46536
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
129045
x-xss-protection
0
server
cafe
etag
16806126990728334555
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Wed, 19 Jun 2024 06:48:24 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		616 B
320 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.mercurynews.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js?ver=2.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ac888a811086e5e08352c3dc0d0b704206641c37f78b1932c3ca956367aed497
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:00 GMT
g.gif
pixel.wp.com/ 		50 B
116 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=116372247&post=9968021&tz=-7&srv=www.mercurynews.com&hp=vip&j=1%3A12.2.1&host=www.mercurynews.com&ref=&fcp=993&rand=0.7794156120439586
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:00 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
2615.svg
s.w.org/images/core/emoji/14.0.0/svg/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/14.0.0/svg/2615.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
8b8afd8f60833ca51907899d4a3279cdfd355282858ba8a73cd1034d2a1e31ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz 1
date
Tue, 20 Jun 2023 19:44:00 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 03:50:38 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
accept-ranges
bytes
content-length
1294
expires
Thu, 31 Dec 2037 23:55:55 GMT
1f451.svg
s.w.org/images/core/emoji/14.0.0/svg/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/14.0.0/svg/1f451.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
3916390d4395ed16641c0e23d5e5a1bef9de6ce71b02c3941c0ee6f2d899c806
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz 1
date
Tue, 20 Jun 2023 19:44:00 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 03:53:43 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
accept-ranges
bytes
content-length
1311
expires
Thu, 31 Dec 2037 23:55:55 GMT
1f393.svg
s.w.org/images/core/emoji/14.0.0/svg/ 		958 B
1018 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/14.0.0/svg/1f393.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
14e71be3ff5aa2e7773210530b6f25ac38218c1833c4efec611f8c89e650db52
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz 1
date
Tue, 20 Jun 2023 19:44:00 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 03:47:26 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
accept-ranges
bytes
content-length
958
expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
14f3a2330f6d02bcd5407635a03c7ab8ed1aa494914c05881137c5e86ae20acf

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
img/png
truncated
/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f6d8894bccb6968f9c55a23894a63a454f3425a7a4c19251ba01d9e3493084a0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
img/png
state-ny.png
www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/state-ny.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f9c4ffcfab2c93ba07bd2d4a2dd53a1d23faace457ade18c52c3f4ea67b8ea68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz1 85 187 443
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
etag
"6398f1fb-26da"
x-cache
HIT
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
9946
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 05:26:29 GMT
x-content-type-options
nosniff
age
397051
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48412
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 15 Jun 2024 05:26:29 GMT
vitals
www.foo.software/api/ 		0
96 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.foo.software/api/vitals
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
137.184.240.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.25.0 / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:00 GMT
server
nginx/1.25.0
x-powered-by
Express
860f5dc3-5da4-4473-bd53-26bd3faf3258
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/860f5dc3-5da4-4473-bd53-26bd3faf3258
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
2ef02bc8-1baa-41c6-9026-1678e888aa82
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/2ef02bc8-1baa-41c6-9026-1678e888aa82
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
d8d9c077aeb2f07c7fe3017ecf6d44ca
a869.mercurynews.com/plugin/plugin/ 		233 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/plugin/plugin/d8d9c077aeb2f07c7fe3017ecf6d44ca
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
d623d4148afe3958f8cf929fccf8a2661b93a30e7f0550fd26f478dca78ab492
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 13 Jun 2023 20:26:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
602257
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
56480
x-xss-protection
1; mode=block
last-modified
Mon, 12 Jun 2023 20:26:23 GMT
server
-
etag
d8d9c077aeb2f07c7fe3017ecf6d44ca
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
kjwxz0fYwmFQDwOvFMiBxa2n8dfA706u7AU7kksW_FWnJ-qFlLIBGw==
expires
Wed, 12 Jun 2024 20:26:23 GMT
quant.js
secure.quantserve.com/ 		22 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:b08a:1dc5:659b:4055 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
etag
"sLp6xTjO7svFVaOemhLWUQ=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Tue, 27 Jun 2023 19:44:00 GMT
asyncPixelSync
pixel.sitescout.com/dmp/ Frame EA47
Redirect Chain
  • https://pixel.sitescout.com/dmp/asyncPixelSync
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
207.198.113.205 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
A /
Resource Hash
95bba4baf05ca525916be57e936921d45491734debfd9f197030ffbf6835b083

Request headers

Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=0,no-cache,no-store
content-length
1162
content-type
text/html;charset=UTF-8
date
Tue, 20 Jun 2023 19:44:00 GMT
expires
Tue, 11 Oct 1977 12:34:56 GMT
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
server
A

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:00 GMT
location
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
server
A
config.js
cdn.confiant-integrations.net/3IyQ81Wnn-d6bieQLuWeDuN4PWM/gpt_and_prebid/ 		106 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.confiant-integrations.net/3IyQ81Wnn-d6bieQLuWeDuN4PWM/gpt_and_prebid/config.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:99f6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
781b3e8726a42112cd2192dd9654cf6eaf79525c7780e3c4fd8469125cc99563

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 20 Jun 2023 18:45:48 GMT
server
cloudflare
x-amz-request-id
C5AWVG1YX67TQFT2
age
841
etag
W/"73b5877229bc86a7af5b3f53f5edaef7"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=900, stale-while-revalidate=3600
cf-ray
7da681044b4a33ff-YUL
alt-svc
h3=":443"; ma=86400
x-amz-id-2
8bqhK+WFXQ68hnV/bda6rsQvunsIbJsXr2OjEV50ldcQ0ERBsKwsl4UQrtp9sqR8OHa5V6ZCjb1+ULkLpNCsEg==
launchpad-liveramp.js
launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/ 		9 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/launchpad-liveramp.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.93.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-23.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
21b580c0e786d0ff2b8ef69d2808f19c17e9106f4effdf1771475ac870c81ea1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
WVJHJlCeP1N2IpvGFdgw87IN7xdjr1fa
content-encoding
gzip
via
1.1 346bf51bc00fbeaa3f4c461a781bceb0.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 18:40:38 GMT
x-amz-cf-pop
JFK50-P8
age
3803
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-disposition
attachment; filename="launchpad-liveramp.js"
last-modified
Mon, 18 Jul 2022 17:01:39 GMT
server
AmazonS3
etag
W/"456ed7d264d33c8630706e5b37966010"
vary
Accept-Encoding
content-type
text/javascript
x-amz-cf-id
c0tHizNbWR5fDEw7us4WaUl_-4oEE-fxVzQhDuoYSjbykkosUxXyTA==
js
www.googletagmanager.com/gtag/ 		139 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-11039244145
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80f::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e87e5b0d6887c7e21b48b3750342d785840fc5c462244144bed61526bb8457a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
54616
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:44:00 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1687290240615&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1687290240615&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%...
0
225 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1687290240615&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
13.35.93.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-31.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
via
1.1 827e4274db61b1bc4aa840491aa652a0.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P8
x-amz-cf-id
op7bADkq0Eb0gHPYfLy0ZDRimLvYX0-LQvhsu5TCxOYxPxtz-yUYdw==
x-cache
Miss from cloudfront

Redirect headers

date
Tue, 20 Jun 2023 19:44:00 GMT
via
1.1 827e4274db61b1bc4aa840491aa652a0.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P8
x-cache
Miss from cloudfront
location
/b2?c1=2&c2=6035443&ns__t=1687290240615&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
content-length
0
x-amz-cf-id
sD3ICUcjPnGchfBeOSpV6QV5ar2S1Acr888lzNsWdMZFFpao0PC60Q==
d66dfa6e9938b7de
pixel.sitescout.com/iap/
Redirect Chain
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
0
341 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
207.198.113.205 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:00 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
expires
Tue, 11 Oct 1977 12:34:56 GMT

Redirect headers

location
https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
date
Tue, 20 Jun 2023 19:43:59 GMT
server
AC1.1
content-length
0
ddcd6e3a-beac-48fc-8439-fab3698369f1
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/ddcd6e3a-beac-48fc-8439-fab3698369f1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
f2e99d0e-8ba5-4e1c-a9ca-501ee93b873d
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/f2e99d0e-8ba5-4e1c-a9ca-501ee93b873d
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
763cb929-016e-47f5-9b3c-8196cd83aabf
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/763cb929-016e-47f5-9b3c-8196cd83aabf
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
104636f6-4fcc-414d-beba-43761ea72c67
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/104636f6-4fcc-414d-beba-43761ea72c67
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 		30 B
813 B 		Script
General
Check archive.org
Download Go to
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?bcsessionid=&&callback=bc_json824
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.200.130.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-200-130-143.compute-1.amazonaws.com
Software
- /
Resource Hash
8b1ce8f1d98dd6f410e69411b02f8ddb640c362854ca9c0a9a01c4a21791af84
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
50
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-107-138.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
Zm_tZQQ808JKRizBfXGgSN2OWn8Z6JUU
content-encoding
gzip
via
1.1 6fde4eba6716c9f80db3b63d251f248c.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 12:05:04 GMT
x-amz-cf-pop
JFK50-P3
age
27537
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 26 May 2023 01:35:48 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
vary
Accept-Encoding,Origin
x-amz-cf-id
TLrqyLBLZLKUIMtUx_FiIgYdAbPt5mvYnQu_jqkzPT286ObwRKlszA==
standard-player.html
tags.remixd.com/player/v5/players/ 		129 KB
30 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://tags.remixd.com/player/v5/players/standard-player.html
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-63.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7f5d73c848836745a93ff7aa540a8f83f9899e3668628f42e9ba0cc6ef5e0b32

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:32 GMT
content-encoding
gzip
via
1.1 3aa2aa1b7b816f70e94675c9a63f98d0.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR50-C1
age
29
x-cache
Hit from cloudfront
content-length
29730
last-modified
Tue, 21 Jun 2022 15:31:59 GMT
server
AmazonS3
etag
"9a2e807a291cbaccaab15c40f0629813"
access-control-max-age
60
access-control-allow-methods
GET, HEAD
content-type
text/html
access-control-allow-origin
*
cache-control
public,max-age=1800
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges
bytes
x-amz-cf-id
vtGhpT3_F5A14nq6EvgTKl5SE5r2UX3xG3GMvCuLbL2iXKvnJ309PA==
ingest
i.viafoura.co/v3/www.mercurynews.com/ 		67 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.viafoura.co/v3/www.mercurynews.com/ingest?t=%7B%22view%22%3A%7B%22domain%22%3A%22www.mercurynews.com%22%2C%22siteUuid%22%3A%2200000000-0000-4000-8000-c86bf0725f23%22%2C%22pageViews%22%3A1%2C%22outgoing%22%3A10%2C%22sessionStart%22%3A1687290240%2C%22isRecirculation%22%3Afalse%2C%22uniqueId%22%3A%2268c652e6-3b14-4e77-9213-660e8ebf8a4b%22%2C%22firstVisit%22%3A1687290240%2C%22previousVisit%22%3A1687290240%2C%22currentVisit%22%3A1687290240%2C%22visitCount%22%3A1%2C%22referrerStart%22%3A1687290240%2C%22refVisitCount%22%3A1%2C%22ref%22%3A%7B%22medium%22%3A%22direct%22%2C%22source%22%3A%22%22%2C%22sharer_uuid%22%3A%22%22%2C%22terms%22%3A%22%22%7D%7D%2C%22meta%22%3A%7B%22domain%22%3A%22www.mercurynews.com%22%2C%22site%22%3A%2200000000-0000-4000-8000-c86bf0725f23%22%2C%22section%22%3A%2200000000-0000-4000-8000-c86bf0725f23%22%2C%22pageImage%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1.jpg%3Fw%3D1024%26h%3D683%22%2C%22ref%22%3A%7B%7D%2C%22vf%22%3Afalse%2C%22url%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22path%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22title%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%E2%80%99%20ex-Spotify%20exec%20tells%20BBC%22%2C%22privilege%22%3A%22guest%22%2C%22page_type%22%3A%22article%22%2C%22page_description%22%3A%22Even%20though%20Markle%20only%20produced%2012%20hours%20of%20podcast%20content%20in%202%201%2F2%20years%2C%20she%20possibly%20earned%20far%20more%20money%20than%20The%20Wknd%20for%20%E2%80%98Blinding%20Lights%2C%E2%80%99%20the%20most%20streamed%20song%20in%20Spotify%26%238%E2%80%A6%22%2C%22topics%22%3A%5B%5D%2C%22amp%22%3Afalse%2C%22thirdparty_enabled%22%3Afalse%2C%22container_id%22%3A%229968021%22%7D%2C%22ua%22%3A%7B%22nl%22%3A%22en-US%22%2C%22nu%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36%22%2C%22sr%22%3A%221600x1200%22%2C%22sd%22%3A24%2C%22vp%22%3A%221600x1200%22%2C%22dt%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify%22%2C%22de%22%3A%22UTF-8%22%2C%22dl%22%3A%22en-US%22%7D%2C%22rq%22%3A%22a771bdaf-ff17-47f7-97ed-6ac01be2afef%22%2C%22w%22%3A%5B%22vf-conversations%22%2C%22vf-tray%22%2C%22vf-content-recirculation%22%5D%2C%22event_type%22%3A%22analytics.view_lite%22%7D
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.55.146.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-55-146-213.compute-1.amazonaws.com
Software
/
Resource Hash
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:44:00 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
67
expires
Fri, 01 Jan 1990 00:00:00 GMT
load.js
pm-widget.taboola.com/medianewsgroup-network/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pm-widget.taboola.com/medianewsgroup-network/load.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
986ccecb5ddec6d653cdb03022cbb35af07301b752cad8ac1d6c7aa66a11e661

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
iVYX3NWtVvLgaZWbuxTvffzyb1PlHiYS
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Tue, 20 Jun 2023 19:44:00 GMT
x-amz-request-id
X6YEKWD34AR5NGS6
age
194
x-cache
HIT, HIT
content-length
1078
x-amz-id-2
7b9FNLhXy4GnVVy+nbp9g24EBAwM15yM/81aPsFz3MTVqszOmj8qKD5O2ua7ukyyGC3/SGH+NaM=
x-served-by
cache-bur-kbur8200062-BUR, cache-yyz4535-YYZ
last-modified
Tue, 30 May 2023 04:23:23 GMT
server
AmazonS3
x-timer
S1687290241.890268,VS0,VE4
etag
"a9928842e0a03e30273550ed905b9329"
vary
Accept-Encoding,,
content-type
application/javascript; charset=utf-8
cache-control
max-age=300
accept-ranges
bytes
x-cache-hits
29145, 1
fp.min.js
fp-cdn.azureedge.net/prod/dfm/ 		65 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fp-cdn.azureedge.net/prod/dfm/fp.min.js?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C6F) /
Resource Hash
f3988a8a95c5faec9bb5307667596b220a12d277072950244393b5f33091e2fb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
content-md5
VJ6k3v9dRV/0qT39eqFDjw==
age
19965
x-cache
HIT
content-length
23424
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 14:09:43 GMT
server
ECAcc (nya/1C6F)
etag
0x8DB6B4EABC41F1B
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
f26d5fd1-801e-003f-7f81-a33f1d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
g2insights.min.js
g2insights-cdn.azureedge.net/prod/dfm/ 		220 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g2insights-cdn.azureedge.net/prod/dfm/g2insights.min.js?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C11) /
Resource Hash
743fab9929b06e6ea08ee7296b84d0068d27d9fe7552b69f351a3298b968910a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:00 GMT
content-encoding
gzip
content-md5
3vlRE270poARifXWcdSFQA==
age
43024
x-cache
HIT
content-length
49062
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:19:27 GMT
server
ECAcc (nya/1C11)
etag
0x8DB6B155BAB7A80
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
866cddb9-601e-0045-604b-a3225d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
t8y9347t.min.js
cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/ 		879 KB
205 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C1A) /
Resource Hash
1313e544d95566c0ed767f40117a8287940c2856fb450d6a4224b8db33a97902

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
content-md5
TKR/2Tq6xUUECucxJTe0nw==
age
1551
x-cache
HIT
content-length
209412
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:14:24 GMT
server
ECAcc (nya/1C1A)
etag
0x8DB6B14A70BE01E
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
02973d82-b01e-0046-04ab-a3c339000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
rules-p-4ctCQwtnNBNs2.js
rules.quantcount.com/ 		3 B
449 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-4ctCQwtnNBNs2.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:a600:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 03:07:12 GMT
via
1.1 8f53b5d73ff2f5f8cae7b49606b79bd4.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-C2
age
59809
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
3
last-modified
Sat, 04 Mar 2017 19:57:14 GMT
server
AmazonS3
etag
"8a80554c91d9fca8acb82f023de02f11"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
x-amz-cf-id
ZX_BmTl64l68JdvDBKsEoQsjbDlB19EFcGSGymQyOoFyAVuU_5-fbQ==
pbjs
htlb.casalemedia.com/openrtb/ 		36 B
548 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/openrtb/pbjs?s=945271
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89450305fe6b6f102efbe6354e00ef976d0cb49fc27085d21ec03efd2a4cdef6

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:01 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BjMnHGQ1rPmK4GuiF1gvgguOxJBkLS6aebH76RLPOSU9324Z90KfKtg5p2FCyxhoo2X4ckZuX0qLe%2BRvERDEk8VRm1udGyQm2gXhoBnj4lUMM9Za323TMMDyCR4OUb%2B0n5CUpzBB"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
7da681067cdfa1ed-YYZ
alt-svc
h3=":443"; ma=86400
content-length
36
expires
0
auction
tlx.3lift.com/header/ 		19 B
578 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=7.46.0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tmax=2000&us_privacy=1---
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.164.26.28 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-164-26-28.compute-1.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:01 GMT
accept-ch
sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list
x-auction-status
12, 12, 12
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
prebid
ads.yieldmo.com/exchange/ 		0
228 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=7.46.0&p=%5B%7B%22placement_id%22%3A%22htlad-1-gpt%22%2C%22callback_id%22%3A%2210a0833b4a7987b%22%2C%22sizes%22%3A%5B%5B300%2C50%5D%2C%5B320%2C50%5D%5D%2C%22ym_placement_id%22%3A%223263962355775513258%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%231%22%2C%22tid%22%3A%2273cda8a7-7d91-4bd6-aa8f-4db354ba5785%22%2C%22auctionId%22%3A%22d694fcf4-f877-42f9-acb0-6d8130777d58%22%7D%2C%7B%22placement_id%22%3A%22htlad-3-gpt%22%2C%22callback_id%22%3A%221161d0af41a6edf%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%2C%5B970%2C250%5D%5D%2C%22ym_placement_id%22%3A%223263962357730058934%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%231%22%2C%22tid%22%3A%2262f718cc-ae35-452b-a614-226bb7fb43dd%22%2C%22auctionId%22%3A%22d694fcf4-f877-42f9-acb0-6d8130777d58%22%7D%2C%7B%22placement_id%22%3A%22htlad-6-gpt%22%2C%22callback_id%22%3A%2212b2e4bae76e9cb%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B300%2C1050%5D%2C%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%223263962352562676374%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231%22%2C%22tid%22%3A%2224f1d729-8923-4a11-9165-f44d72ae151a%22%2C%22auctionId%22%3A%22d694fcf4-f877-42f9-acb0-6d8130777d58%22%7D%5D&page_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bust=1687290240972&dnt=false&description=Meghan%20Markle%20only%20produced%2012%20hours%20of%20podcast%20content%20in%202%C2%BD%20years%2C%20yet%20possibly%20earned%20more%20than%20The%20Weeknd%20for%20his%20huge%20hit%20%27Blinding%20Lights.%27&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%22%22%7D&us_privacy=1---&pr=&scrd=1&title=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&w=1600&h=1200
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.207.246.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-207-246-26.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:01 GMT
access-control-allow-credentials
true
x-robots-tag
none,NOINDEX,NOFOLLOW
access-control-allow-methods
POST, GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma
cdb
bidder.criteo.com/ 		0
198 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=35&wv=7.46.0&cb=47447413763&lsavail=1
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:00 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
prebid
ib.adnxs.com/ut/v3/ 		366 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
f9a269cb808e24336f19430d384c3cc05b4817c3d637eefb294db4072a7fccd8
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:01 GMT
AN-X-Request-Uuid
630ccaff-6ad2-43fd-ac50-2017d5c59a31
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
366
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		0
0
fastlane.json
fastlane.rubiconproject.com/a/api/ 		528 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768258&size_id=2&alt_size_ids=55%2C57&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=62f718cc-ae35-452b-a614-226bb7fb43dd&l_pb_bid_id=23b6c8b2c24a0c&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=62f718cc-ae35-452b-a614-226bb7fb43dd&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%231&slots=1&rand=0.13938465246925635
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::116 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
057f393e06cebae396eaa41b3e932ea15b338d640a4b890d49c4810210b3bd26

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:02 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
528
expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		0
0
translator
hbopenbid.pubmatic.com/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:00 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
config
c.amazon-adsystem.com/cdn/prod/ 		320 B
680 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=3391&u=https%3A%2F%2Fwww.mercurynews.com
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-107-138.jfk50.r.cloudfront.net
Software
Server /
Resource Hash
7bd8b3e8c5d0f5c0a1c5ed3b69c09e4ae5edb40519ad8a1882b007ac3bf91901

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:13:51 GMT
via
1.1 c824f42276c55792245504036b5383fa.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
JFK50-P3
age
5409
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
content-length
320
x-amz-cf-id
-xSs2LBgPLEBN2SY03WsubFxAUIwxyeg3PFtxFEAbO17mabZ5xeUmA==
bid
aax.amazon-adsystem.com/e/dtb/ 		244 B
686 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://aax.amazon-adsystem.com/e/dtb/bid?src=3391&u=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&pid=51ms8uhq6pYmc&cb=0&ws=1600x1200&v=23.612.1758&t=2000&slots=%5B%7B%22sd%22%3A%22htlad-1-gpt%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-3-gpt%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-6-gpt%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22160x600%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%5D&gpp=DBACOe~~~&gpp_sid=%5B5%5D&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.98.157 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-98-157.jfk50.r.cloudfront.net
Software
Server /
Resource Hash
f8e60fa507399273a3862f6ca5b4daf3df1b225801d641c564a10336e84773e5
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
strict-transport-security
max-age=47474747; includeSubDomains; preload
via
1.1 c50e3f7de0b772d07240015272b1aff6.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
JFK50-P5
x-amz-rid
5M3448K6NYKPN1Q3V3BV
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
244
x-amz-cf-id
rt11Bs-0i323bKEcNYAVqz8fuUToxJFXb68X5Vhps-k7KbIwAlivEg==
esp.js
cdn.id5-sync.com/api/1.0/ 		83 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/esp.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c216860f82a201e909b917ff2eca53e9787b05ec1fe5a69a0d4b994d95781c5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 20 Jun 2023 07:12:13 GMT
server
cloudflare
x-amz-request-id
0AA5MMW1D4D75B28
age
368
etag
W/"916c7961f99d2ada149bc1a94a1bf864"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
cache-control
public, max-age=3600
cf-ray
7da681076b092267-ORD
x-amz-id-2
pZ2hymLqQeJXCjbmykclkZXZX6RgnrHQIR8tFdShl7iO454JH/iLQJ5idIl9bTRAqVhFggzdQzSctaoUq3O1Cw==
pubcid.min.js
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 		732 B
644 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:44:01 GMT
x-content-type-options
nosniff
content-encoding
br
age
30259
x-jsd-version
master
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
439
x-served-by
cache-fra-eddf8230042-FRA, cache-yul12822-YUL
x-jsd-version-type
branch
etag
W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
uid2SecureSignal.js
cdn.prod.uidapi.com/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2511:6e00:a:e047:753:be1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
null
Date
Tue, 20 Jun 2023 09:17:00 GMT
Via
1.1 54a56da0fe0bae919389c7d572d4720e.cloudfront.net (CloudFront)
Last-Modified
Thu, 04 May 2023 00:14:06 GMT
Server
AmazonS3
X-Amz-Cf-Pop
JFK50-P6
Age
37622
x-amz-server-side-encryption
AES256
ETag
"4d5acbf33f4a0592ac0515db92fe88e6"
X-Cache
Hit from cloudfront
Content-Type
text/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1858
X-Amz-Cf-Id
zBeBDQkv7u28lMoX_aR5TYll3rB8Waf5NYKQD-E7AmA1pn0YCG-ZBg==
publishertag.ids.js
static.criteo.net/js/ld/ 		42 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.ids.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
839c424b188a9bdafd46e5b643a2c5afb4b7df5e51f0321ffafd5f23b118e259
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 31 May 2023 13:09:50 GMT
server
nginx
etag
W/"6477471e-a980"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:01 GMT
sync
gum.criteo.com/ 		46 B
288 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS&us_privacy=1---&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:00 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
389309
expires
60
analytics.js
www.google-analytics.com/ 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 20 Jun 2023 18:39:17 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
3884
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Tue, 20 Jun 2023 20:39:17 GMT
demconf.jpg
dpm.demdex.net/ Frame EA47
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
42 B
940 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
3.215.224.52 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-215-224-52.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

DCS
dcs-prod-va6-2-v048-0540ae253.edge-va6.demdex.com 8 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
L+rWBYjiS0U=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-va6-2-v048-05fb1d08a.edge-va6.demdex.com 0 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
wFh7I2DLSdQ=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
check
pixel.tapad.com/idsync/ex/receive/ Frame EA47
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
95 B
435 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

date
Tue, 20 Jun 2023 19:44:01 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
pixel.gif
load77.exelator.com/ Frame EA47
Redirect Chain
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=&xl8blockcheck=1
  • https://load77.exelator.com/pixel.gif
43 B
367 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://load77.exelator.com/pixel.gif
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
2a02:6ea0:c400::11 New York, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
newyorkUSNY
date
Tue, 20 Jun 2023 19:44:02 GMT
x-cache
HIT
x-77-cache
HIT
x-age
736348
x-accel-date
1686553894
content-length
43
x-77-nzt
AZySJBZ6bKj/XDwLAA
x-accel-expires
@1687590694
last-modified
Wed, 25 Oct 2017 17:03:56 GMT
server
CDN77-Turbo
etag
"59f0c3fc-2b"
x-77-nzt-ray
1e192d08dfcb45738201926459df670d
content-type
image/gif
access-control-allow-origin
*
accept-ranges
bytes

Redirect headers

date
Tue, 20 Jun 2023 19:44:01 GMT
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location
https://load77.exelator.com/pixel.gif
content-type
image/gif
cache-control
no-cache
access-control-allow-credentials
true
content-length
0
um
sync.teads.tv/ Frame EA47 		23 B
278 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=73&uid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.197.46 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-200-197-46.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Tue, 20 Jun 2023 19:44:01 GMT
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:01 GMT
cache-control
max-age=0, no-cache, no-store
server
akka-http/10.2.10
content-length
23
content-type
image/gif
qmap
sync.crwdcntrl.net/ Frame EA47
Redirect Chain
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=&ct=y
49 B
734 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=&ct=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
23.20.148.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-20-148-40.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:01 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.11.3
content-length
49
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:01 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=&ct=y
cache-control
no-cache
x-server
10.40.36.226
content-length
0
expires
0
65c25df5710daac71512ce59624729c1
a869.mercurynews.com/plugin/library/ 		438 KB
138 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/plugin/library/65c25df5710daac71512ce59624729c1
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
d8b0939d4ad62069a09916859d301d5a0d9c00e9174ad682c53bc122a35bf80e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 31 May 2023 07:17:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
1772821
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
140593
x-xss-protection
1; mode=block
last-modified
Tue, 30 May 2023 07:17:00 GMT
server
-
etag
65c25df5710daac71512ce59624729c1
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
nQjpiUyZ-j8ORA65BMnLNtJTfcCmLHsBhztC_JL_0aCSyQ8d5XZVUg==
expires
Thu, 30 May 2024 07:17:00 GMT
LB-Zone-3
a869.mercurynews.com/DG/DEFAULT/rest/rpc/821/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821/LB-Zone-3?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A01%2B00%3A00&ts=1687290241147
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
5bdd273208626275755db12c0c38e9df2cae6221aa4cea3d467daf54d0cd4db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
1144
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
XyootlObmZpg9mzwyLfnYXFp4-I5tIm2WCop3gnfWIdxxJyRPWRhlQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		254 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
63bf0a6c2c57a373235701ad52d72b013560770465fcd10ca88a8ef5158d8b24
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
88676
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 20 Jun 2023 19:44:01 GMT
tag.js
s.btstatic.com/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.btstatic.com/tag.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.37.104.225 Englewood, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-37-104-225.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:01 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Feb 2023 15:10:42 GMT
Server
nginx
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Content-Type
application/javascript
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
12525
ml.br.js
js.matheranalytics.com/static/ltm/ma23578/wp/27/
Redirect Chain
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1627
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
150 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
107.178.250.234 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
234.250.178.107.bc.googleusercontent.com
Software
nginx /
Resource Hash
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 19 Jun 2023 20:49:16 GMT
content-encoding
br
via
1.1 google
last-modified
Mon, 12 Jun 2023 20:29:05 GMT
server
nginx
age
82485
etag
"85aef1250c3704a499337dcfc565d621"
vary
Accept-Encoding
x-cache
HIT Mon, 12 Jun 2023 20:39:11 GMT
content-type
application/x-javascript
cache-control
public,max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44324

Redirect headers

date
Tue, 20 Jun 2023 19:44:01 GMT
via
1.1 google
server
nginx
vary
Accept-Encoding
location
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
cache-control
public, max-age=269200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-served-by
1-gc-northeast1c-54231017
f5b9682c-1e72-4955-83c1-8400c9137564
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/f5b9682c-1e72-4955-83c1-8400c9137564
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
902b6d4d-d98e-4572-bfde-34dd02a5bcc2
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/902b6d4d-d98e-4572-bfde-34dd02a5bcc2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
5862cb03-af27-4f55-8127-41bb83d4529d
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/5862cb03-af27-4f55-8127-41bb83d4529d
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
c756d7b5-52d1-4dc5-b6a8-fd6332ed81f5
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/c756d7b5-52d1-4dc5-b6a8-fd6332ed81f5
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
/
cmp.osano.com/ Frame 68B7 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:2e00:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45267
content-encoding
br
content-type
text/html
date
Tue, 20 Jun 2023 07:09:35 GMT
etag
W/"287b497c992487af362d33204f87d28f"
last-modified
Thu, 21 Oct 2021 22:01:08 GMT
referrer-policy
strict-origin-when-cross-origin
server
AmazonS3
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding Origin
via
1.1 3b0649a8bee506c1d7498462d39e6c44.cloudfront.net (CloudFront)
x-amz-cf-id
4pqoK2l43M7N_FOtpEf-04R66z8cOUvywhYe40o1iQFCUTuN4LuZ7Q==
x-amz-cf-pop
JFK50-P5
x-amz-version-id
xT1PkIFehetvNf5lINcU02FbT3u47kBr
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-xss-protection
1; mode=block
record
consent.api.osano.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://consent.api.osano.com/record
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.116.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-116-119.jfk50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
*
content-length
0
content-type
application/json
date
Tue, 20 Jun 2023 19:44:01 GMT
via
1.1 cedbf7a51c689bd1e26af4b73768d270.cloudfront.net (CloudFront)
x-amz-apigw-id
G1UsQEcXIAMFyNg=
x-amz-cf-id
6Li7135rxZT4KQC3OQ6Uq7i8nZbnAy97bqTdod2XYHNCHr_dPVnIVg==
x-amz-cf-pop
JFK50-P6
x-amzn-requestid
39efbef4-a734-46a8-b2cc-78bb8b33ec59
x-cache
Miss from cloudfront
load.js
s.ntv.io/serve/ 		575 KB
157 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ntv.io/serve/load.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.69.53 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-69-53.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
c5993f8467dfbb45dfd3f751abd48089b840da8105caca380d0bc0f8ec387b11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:01 GMT
Content-Encoding
gzip
x-amz-request-id
13HJYN9HYNR8XE12
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
x-amz-id-2
TgsWHEFGHEmJKhPKFdF8Kwppu7e/h8b/yl6lVT3srrteTT06ZNXzbhWDMZFWah0IKAyP2gAfaA8=
Last-Modified
Fri, 16 Jun 2023 13:31:32 GMT
Server
AmazonS3
ETag
"9ac11617889ee511c7463118047f195a"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
a-04i4.min.js
b-code.liadm.com/ 		42 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b-code.liadm.com/a-04i4.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:23cb:9a00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
dc0da2082ec514b4250ffe29a176826c3aef94d4ca0f887586528add66a99f16

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 06:23:34 GMT
content-encoding
gzip
via
1.1 f577ca8c3771798c088df2efc06d2bc4.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P1
age
48027
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
"public, max-age=86400"
x-amz-cf-id
J9DaUGy3t_NxHvkt5jJSlSRcVI8QMChaZ-bE5Ed5pzS8Osy06CXmYA==
beacon.js
sb.scorecardresearch.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.93.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-31.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 02:46:03 GMT
content-encoding
gzip
via
1.1 827e4274db61b1bc4aa840491aa652a0.cloudfront.net (CloudFront)
last-modified
Thu, 09 Mar 2023 09:22:40 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P8
age
61079
etag
W/"a06e7a176f40dc26aa5e9567ac9d2d5e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400
x-amz-cf-id
Cry41OrReamOFsCd2hoW648P-jpj502FioocEvAzSMNHAUG0kmg6EA==
json
trc.taboola.com/medianewsgroup-mercurynews/trc/3/ 		104 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/medianewsgroup-mercurynews/trc/3/json?tim=19%3A44%3A01.268&lti=deflated&data=%7B%22id%22%3A442%2C%22ii%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1687254511415%2C%22vi%22%3A1687290241259%2C%22cv%22%3A%2220230620-6-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22bv%22%3A%220%22%2C%22wc%22%3Atrue%2C%22ul%22%3A%5B%22en-US%22%2C%22en%22%5D%2C%22uad%22%3A%7B%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D%2C%22cmps%22%3A0%2C%22ga%22%3Afalse%2C%22ccpa_ps%22%3A%221---%22%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bu%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22vpi%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A6958%2C%22nsid%22%3A%22medianewsgroup-network%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A6%2C%22uim%22%3A%22thumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22cd%22%3A5182.578125%2C%22mw%22%3A954.875%7D%5D%2C%22cacheKey%22%3A%22text%3D%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2CBelow%20Article%20Thumbnails%3Dthumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D&llvl=2
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20230620-6-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f696848774a0c784c368e7c24c5902acfeee7f611d04b6ac48c17991ebbe4d0b

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

x-vcl-time-ms
1195
date
Tue, 20 Jun 2023 19:44:02 GMT
content-encoding
gzip
via
1.1 varnish
x-fastly-to-nlb-rtt
21252
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v2
x-served-by
cache-yyz4535-YYZ
server
nginx
x-timer
S1687290241.289972,VS0,VE1195
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
record
consent.api.osano.com/ 		0
438 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://consent.api.osano.com/record
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.116.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-116-119.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
via
1.1 cedbf7a51c689bd1e26af4b73768d270.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P6
x-amzn-trace-id
Root=1-64920181-156592402bef40c47883d32c
x-amzn-requestid
6d3d0ad5-b09c-4578-85a7-e09849db24e7
x-cache
Miss from cloudfront
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
*
access-control-allow-headers
Accept, Authorization, Content-Length, Content-Type, Origin, X-Requested-With
x-amz-apigw-id
G1UsRGgAIAMFcPw=
x-amz-cf-id
XthvXgNxXU5060vLipMiyxx-mlNnq5lmYBIM7VJZqjIyRgyW2YcTrw==
FUtg69tL.js
cdn.jwplayer.com/libraries/ Frame 1559 		108 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jwplayer.com/libraries/FUtg69tL.js
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2209:4400:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
openresty /
Resource Hash
ebe57ea45a2226e928d739f6bdd9bb1d0425134d06a8d88cc0c669cfcb3123e2

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:42:53 GMT
content-encoding
gzip
via
1.1 0146c8129cacdacca96753291cf27ec4.cloudfront.net (CloudFront)
server
openresty
x-amz-cf-pop
EWR53-P1
age
68
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=180
x-robots-tag
noindex, indexifembedded
content-length
41225
x-amz-cf-id
rjZRyMcwYg9a2Msts3wtyeTSjVkHFaADX1Yf-VQuAeA_VHcKOJc3ow==
recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.228.182.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-228-182-143.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-max-age
1800
allow
GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length
0
date
Tue, 20 Jun 2023 19:44:01 GMT
vary
Origin Access-Control-Request-Method Access-Control-Request-Headers
recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 		0
456 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.228.182.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-228-182-143.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:01 GMT
content-length
0
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
pmk-20220605.3.js
pm-widget.taboola.com/medianewsgroup-network/ 		109 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pm-widget.taboola.com/medianewsgroup-network/pmk-20220605.3.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
463b965e90a6c1e92161047e09f18a7b0c5bfe39c59de875536a744922f18285

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
EpZzlJAx.0y9.uC5nEuXRKLfz.04Efo4
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Tue, 20 Jun 2023 19:44:01 GMT
x-amz-request-id
DAM11Y8WW0441GFC
age
1869634
x-cache
HIT, HIT
content-length
30633
x-amz-id-2
R1WtWYmDdmYhnE6C2z0FDpK8g1Uy3NwQv2MAMZmqF1e28TOsr7BJebrxzYXfpeuqVE45bHxiAj4=
x-served-by
cache-bur-kbur8200175-BUR, cache-yyz4535-YYZ
last-modified
Tue, 30 May 2023 04:23:22 GMT
server
AmazonS3
x-timer
S1687290241.377914,VS0,VE0
etag
"ad88e58bdaa38d8b8e9028ad431a5e02"
vary
Accept-Encoding,,
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
4699, 29
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2c95bbac8e167a1fd9297768d9c45d1f50db54733b750ae889b3a5efd2fae8fa

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/svg+xml
t8y9347t.min.css
cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/ 		389 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.css?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C04) /
Resource Hash
8f5b3f7177261796d36de2d220664c09162d3877eb2e3868406c27ac952520a1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
content-md5
w1JcKG+K3j0xPG8xaqE6vA==
age
1550
x-cache
HIT
content-length
55210
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:14:24 GMT
server
ECAcc (nya/1C04)
etag
0x8DB6B14A70ACED9
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
011c085f-f01e-001a-1dab-a39661000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
increment
id5-sync.com/api/esp/ 		0
328 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/api/esp/increment?counter=no-config
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
141.95.98.64 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3216658.ip-141-95-98.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:01 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
wrap.js
cdn.confiant-integrations.net/gptprebidnative/202305161109/ 		247 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.confiant-integrations.net/gptprebidnative/202305161109/wrap.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:99f6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9b8757ef83403b67a3f6d10da0c8f4259179fe48a775020aeb65ab9e1791cc3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 16 May 2023 15:12:41 GMT
server
cloudflare
x-amz-request-id
FT4HVGQB7CCRFX0J
age
3036261
etag
W/"c445da83949e16f2c7f56d37a9f719f0"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
cf-ray
7da681096d3d33ff-YUL
alt-svc
h3=":443"; ma=86400
x-amz-id-2
nO4SmJlCFWE3tYLd1eHTnRzftKXrxOvU4kwqYbbPBc9j7s8g5EWJxiHO9/oA0MLoZxzVGL5i6BU=
card-interference-detector.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/card-interference-detector.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2aa50c9706f2175ff0a141b65a82f4c0a8907f75779f00d9d29d31a09c58121f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
d9g80bYGwlrI5Ugcc2XKm7V6T0Er6clB
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:01 GMT
x-amz-request-id
RM11Q39FQVM8GGY3
age
33618
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
2179
x-amz-id-2
R3YXZnRUXUW3QK7y9j8AARuHUMAGtXZ3GD+ck+pl9dhZnRFmnPE2W4jZdqIqvmnSFY5jHfUrVww=
x-served-by
cache-yyz4535-YYZ
last-modified
Tue, 20 Jun 2023 10:23:43 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290242.510578,VS0,VE0
etag
"72624d6dc4cb1ef95c5884952b9a75a2"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
55
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
4355
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1687290241070&cv=11&fst=1687290241070&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=1333905033.1687290241&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f777c35c89d1682e92541bdb23748223b52de0e588908a991a43df2129fdc62e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1437
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
launchpad.bundle.js
launchpad.privacymanager.io/1/ 		25 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://launchpad.privacymanager.io/1/launchpad.bundle.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.116.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-116-116.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b9d318b3157ccbfc3bb00e82a446613294f9a592c01537662386bd848882b7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
IBczV1acfLsLLKzHm11PkizTXPxE9_cH
content-encoding
br
via
1.1 08307cdad31639e360e0351e9156d6ba.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 19:42:36 GMT
x-amz-cf-pop
JFK50-P6
age
86
x-amz-server-side-encryption
AES256
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:eu-west-1:469675294282:build/LaunchPadLibraryBuild-prod:f09170b2-5416-4e55-be91-38e5eec207ec
x-cache
Hit from cloudfront
x-amz-meta-codebuild-content-md5
a78f2a5a4864424e54348ce47b156abb
last-modified
Thu, 10 Mar 2022 13:10:48 GMT
server
AmazonS3
etag
W/"3e312624cdc2445a38a716f92dc3c0cd"
vary
Accept-Encoding
content-type
application/x-javascript
x-amz-meta-codebuild-content-sha256
e4ad213b137401d20a50fe1692169cc5f8b39867b6fe39afed7e307e1b9c967e
cache-control
must-revalidate,public,max-age=3600
x-amz-cf-id
XRi3paxRErq31Npsv1mKYS_mmkyjDgIcTJEO3F-RttUs1e0c9CsL-w==
self
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 		613 B
792 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1687290241550
Requested by
Host: fp-cdn.azureedge.net
URL: https://fp-cdn.azureedge.net/prod/dfm/fp.min.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.5.15 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4a0fe9f93960096c5eabc3edb9225d43eaec4a308ac0f60dd3db4195dc058da

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 20 Jun 2023 19:44:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LhICq4XabZJgFYJSM4DIXrsTh%2BGCwUzaWNaBZjps%2BUvbElNOynsxhLjWRmqtggyqfa4aRDGDOsUtU%2BjGf9KvaO%2BhT3KwDla4ckrZL8Qwa4XX559h03dlq5ZT3eSu6VIgHABh"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=1800
cf-ray
7da6810a3f5f18c8-EWR
alt-svc
h3=":443"; ma=86400
ai.0.js
az416426.vo.msecnd.net/scripts/a/ 		94 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/79DC) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
1076
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (nya/79DC)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c079a44a-b01e-00b5-74ad-a369c5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Tue, 20 Jun 2023 20:14:01 GMT
index.js
cdn.pranmcpkx.com/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pranmcpkx.com/index.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/7991) /
Resource Hash
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
content-md5
nynBpfvYghYqzIzsvfssRw==
age
206463
x-cache
HIT
content-length
2382
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jun 2022 17:08:13 GMT
server
ECAcc (nya/7991)
etag
0x8DA5083F65AD9E0
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
x-ms-request-id
771178af-101e-005f-22ce-a14382000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
DFM__BANGWPPRODWAB__MERC.json
cdn.czx5eyk0exbhwp43ya.biz/prod/data/dfm/ 		521 KB
522 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/data/dfm/DFM__BANGWPPRODWAB__MERC.json?_=1687290241604
Requested by
Host: cdn.czx5eyk0exbhwp43ya.biz
URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
2943a138fb8248f4ef8d8ac14a988ef46f8bb5d3aa964ff227082c1651e46dbf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
AppendBlob
date
Tue, 20 Jun 2023 19:44:01 GMT
last-modified
Wed, 14 Jun 2023 20:35:44 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-committed-block-count
1
etag
0x8DB6D16EDC2DB4F
content-type
application/octet-stream
access-control-allow-origin
*
x-ms-request-id
2f1f75b3-701e-0059-7aaf-a3703d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
cache-control
no-cache
x-ms-version
2009-09-19
content-length
533460
ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 		631 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.193.97 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:02 GMT
Last-Modified
Tue, 15 Oct 2019 13:44:16 GMT
Server
AmazonS3
x-amz-request-id
RS70SJE02GGX4384
ETag
"ef2cc7f55b7ab677b023e36033e26471"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
631
x-amz-id-2
J+wp5HDgocHW3ZbI3rh25Hm8slljexYVPq3Rk3zES72/jiMiADEGF/iKSX5BLY53ETnuSSTKoQ4=
x-amz-meta-s3b-last-modified
20191015T134358Z
iu3
s.amazon-adsystem.com/ Frame CB09
Redirect Chain
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
373 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
19cf792a649556b6e99d788a69b1e501dc0748c010896e4fd4081eca8ab0983c
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
373
Content-Type
text/html;charset=ISO-8859-1
Date
Tue, 20 Jun 2023 19:44:01 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
KPK61V89YT7084KDSBVG

Redirect headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:01 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
Z30YAWHZYMFD42G8RK3X
141f2bca-e293-4ff0-9090-432ecb40bee6
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/141f2bca-e293-4ff0-9090-432ecb40bee6
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
pixel;r=1816862870;labels=BayAreaNewsGroup;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-wor...
pixel.quantserve.com/ 		35 B
371 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=1816862870;labels=BayAreaNewsGroup;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F;uht=2;fpan=1;fpa=P0-2031367367-1687290240919;pbc=;ns=0;ce=1;qjs=1;qv=c818c8ec-20230509111053;cm=;gdpr=0;us_privacy=1---;ref=;d=mercurynews.com;dst=0;et=1687290241640;tzo=0;ogl=type.article%2Ctitle.Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%252C%E2%80%99%20ex-Spotify%20e%2Curl.https%3A%2F%2Fwww%252Emercurynews%252Ecom%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd%2Cdescription.Even%20though%20Markle%20only%20produced%2012%20hours%20of%20podcast%20content%20in%202%201%2F2%20years%252C%20she%2Csite_name.The%20Mercury%20News%2Cimage.https%3A%2F%2Fwww%252Emercurynews%252Ecom%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1%252Ejp%2Cimage%3Awidth.1024%2Cimage%3Aheight.683%2Cimage%3Aalt.%2Clocale.en_US;ses=e1a89cb7-0770-4ccc-ae3c-e5b1f17ff8ed;mdl=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:b08a:1dc5:659b:4055 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:01 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type
image/gif
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
fddc5adb29bdf95c848ea54469cf60a5
a869.mercurynews.com/templates/ 		479 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/templates/fddc5adb29bdf95c848ea54469cf60a5
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
2f218987261e49e368f7f85f9e5bf66f49f62032e96bb064c43064df8fc4e2fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 26 Mar 2023 19:28:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
7431345
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
71125
x-xss-protection
1; mode=block
last-modified
Sat, 25 Mar 2023 19:28:16 GMT
server
-
etag
fddc5adb29bdf95c848ea54469cf60a5
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
lks_qjElj0iKbLb00jaocr4RLupRAnf55l5UmYedfjubgzfYjoOu7g==
expires
Mon, 25 Mar 2024 19:28:16 GMT
821
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		192 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=53d732a1-8120-4fad-8c05-821f63a4cd3a&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A01%2B00%3A00&ts=1687290241741
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
4763afcb2ded007415b72bae7f50a7260a35a51985de43111524275c11b8247f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
155
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
Qg3_DJc7bSNWx9rnKMwlanePGcfiPuTxjDTfFSWeNYJ5L7-uYKikXw==
expires
Thu, 01 Jan 1970 00:00:00 GMT
fbevents.js
connect.facebook.net/en_US/ 		108 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
64816ef42196992f1120608cafa36df8e03c81064551abb6f23bc00f69bf6727
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:44:01 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27810
x-xss-protection
0
pragma
public
x-fb-debug
p5fU6Agti2AiRsi0r0R3pjzvajC3BCrCZ92KyYp/Q9esEKUyOdpCu0JpgSvPnc3mBOp2G4aGqDH3AVv/NYEpkg==
x-fb-trip-id
1679558926
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
stats
a869.mercurynews.com/rest/recommendations/ 		14 B
850 B 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/rest/recommendations/stats?storeId=0595003b-1825-43bc-89bd-9877ca21042f&action=view&itemId=9968021&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&profileId=53d732a1-8120-4fad-8c05-821f63a4cd3a&isEntrypage=true&hash=788aeb3068b96c1677f6d8b260dbf322&lastmodified=1687284760000&referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&&callback=bc_json825
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
2514bef258fb6cb4e11afb83730adf6738dcb9199b03ec947b093aa8318eb1d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
34
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
text/javascript;charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
x-amz-cf-id
GSddg1kmN9ZsVSVKcQcP4l3xFTCuI4dTyCMON7sJMNLo8Gb44StZUQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
821
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		565 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=53d732a1-8120-4fad-8c05-821f63a4cd3a&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A01%2B00%3A00&ts=1687290241844
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
7e92ab9e4ba75961e7d2bae7f78562a4ce50286563dff26d4fa630a100accec5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
182
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
-c0r6PJwN5PRyqh1BTgMaRr-6ZrnaP3o3WiB6DkLLATpIwif8gLKkg==
expires
Thu, 01 Jan 1970 00:00:00 GMT
821
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		189 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=53d732a1-8120-4fad-8c05-821f63a4cd3a&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A01%2B00%3A00&ts=1687290241845
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
5f5c7cc2b7dbe80e8858146c5ad1bf23f228077e93c109531df8b08c2c03cf62
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
170
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
DweGpW3-v6UIuoqGomtQaSTWN7CDRwR1PzILtaZHcuDYbxyQ1rKl6g==
expires
Thu, 01 Jan 1970 00:00:00 GMT
821
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		189 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=53d732a1-8120-4fad-8c05-821f63a4cd3a&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A01%2B00%3A00&ts=1687290241856
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
65e12db1e4a9e1a532fb6ef30bb1bae9c28cd76e68f346e7fe0af8b60253cf7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
170
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
HwEKfDjSTtDeq1-CUzWA1rH5kxI43cQVcci9iTaz4onJMPYPKggXqA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
821
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		377 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=53d732a1-8120-4fad-8c05-821f63a4cd3a&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A01%2B00%3A00&ts=1687290241858
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
7794e2c0a45ba98df9b859bf73aad7e17c7ad09e0d04c8aa389e6f072ddfa3e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
179
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
rquvgnDp2AYEayRn_ws4cPyEoHmAPLjhFF0qvwZ9Hd0CfKHNi1vg9A==
expires
Thu, 01 Jan 1970 00:00:00 GMT
821
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		5 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=53d732a1-8120-4fad-8c05-821f63a4cd3a&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A01%2B00%3A00&ts=1687290241860
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
24fb187859838f077fa43932d17ce42ee922907e12142d8b9e8f33ff819fb2c4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
2606
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
rbIDO_rIVZ26g7EhYgkY4PFnU15Y02FB35PzpmAyS0Cydlq4c8qKjA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
1x1-pixel.png
ams-pageview-public.s3.amazonaws.com/ 		68 B
448 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ams-pageview-public.s3.amazonaws.com/1x1-pixel.png?id=1a461e4fcca4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.217.228.1 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:03 GMT
Last-Modified
Mon, 26 Oct 2020 16:52:19 GMT
Server
AmazonS3
x-amz-request-id
6CDMZ4CX31N4HMP9
ETag
"91e42db1c66c0b276abf6234dc50b2eb"
Content-Type
image/png
Cache-Control
no-store
Accept-Ranges
bytes
Content-Length
68
x-amz-id-2
8eMfYKO++6MwcTwXAvXjDu8Jvd4mR56AZWEQGnFKTHD+Lecb+qKlMPaAsd7pTMlMdu8U6Dc+2uQ=
collect
www.google-analytics.com/g/ 		0
174 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-LMTT1ZNHB1&gtm=45je36e0&_p=1249931897&cid=690102992.1687290241&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1687290241&sct=1&seg=0&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
css2
fonts.googleapis.com/ Frame 1559 		3 KB
624 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
933ff38629199ba200d23e1a3afda3ca9cae06352169926a4609942ab4d3742b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 19:24:09 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:44:02 GMT
ping.gif
player-files.remixd.com/ Frame 1559 		43 B
586 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://player-files.remixd.com/ping.gif?action=playerImpression&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=1&sessionId=01562e21-aca8-43ae-a2d5-98d769bef4f2&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:02 GMT
x-guploader-uploadid
ADPycdt44l-Su2pQw4-HxzjpZC2A1UvvvEiL6Ooi6QjgwTcHcUaV-QEhmEjvarG1VgAeKbeaUsw3CvehXN59zijcLncwkHYNvEL-
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:44:02 GMT
ping.gif
player-files.remixd.com/ Frame 1559 		43 B
198 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://player-files.remixd.com/ping.gif?action=loading&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=3&sessionId=01562e21-aca8-43ae-a2d5-98d769bef4f2&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:02 GMT
x-guploader-uploadid
ADPycdsaKE2b7MRdBBKsY1bvmScPrGBUP09XR7uOKY2wRM8s_Yk4g3u7VkWnfWaQP1-B3jZqRAwFXguWy_FP-0y9NsdR25TYGHq4
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:44:02 GMT
ping.gif
player-files.remixd.com/ Frame 1559 		43 B
197 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://player-files.remixd.com/ping.gif?action=loaded&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=4&sessionId=01562e21-aca8-43ae-a2d5-98d769bef4f2&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:02 GMT
x-guploader-uploadid
ADPycdvuYA8FXdN_Cze7SbwvONG38bGaOg55SgAQWCCWPv86Z-gFXq5qvy2SpRk74mvsH5nPh1FRyqiCn-Rq6tIGnKaKD7qIpcVi
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:44:02 GMT
2b4ec28d-7412-408a-9c66-a8488e794ffb
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/2b4ec28d-7412-408a-9c66-a8488e794ffb
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
b
sb.scorecardresearch.com/ 		0
317 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b?c1=7&c2=34354936&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1687290242051&ns_c=UTF-8&c3=1&gdpr=0&gdpr_p1t=&gdpr_li=&gdpr_purps=&gdpr_pcc=&cs_cmp_nc=0&cs_cmp_id=279&cs_cmp_sv=1707&cs_cmp_rt=1&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c9=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.93.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-31.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:02 GMT
via
1.1 827e4274db61b1bc4aa840491aa652a0.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P8
x-amz-cf-id
frj8oIa_r8l6LFkAzq-n2E2N5_b0EK2OfX-NOWmmgnaV0m19PkPJ-g==
x-cache
Miss from cloudfront
821
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		11 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/821?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=53d732a1-8120-4fad-8c05-821f63a4cd3a&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A02%2B00%3A00&ts=1687290242100
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
f17d4e620e0a5588a48090a12efea067a96984b306d7bafa21de9cc18fcf8dc7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
2684
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
3O64EUjk1Gqjwz8m4h4SQWIOTrAU9fWsAvdmoDfq_oxH9T7O-roxLA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pv&page=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&artid=9968021&artpubt=1687284760&artsrc=Bay%20Area%20News%20Group&arttype=free&artupt=1687287137&auth=Martha%20Ross&chrcnt=5021&cms=WP&hier=Entertainment%7CThings%20To%20Do&ptype=article&pubname=The%20Mercury%20News&sec=Entertainment&wrdcnt=801&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=4f50e2e9-930b-4fce-94ae-2fa071958192&pid=45fbb049-cd4d-4548-b342-1bd2d9960567&dtm=1687290242118&qnm=_matherq&visible=1&tabid=d1035f59-8a38-44c6-83f8-8befa73f770a&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=1600x6958&tofa=1687290242&vid=1&lvidt=1687290242&duid=ba10b823-5015-4d9c-bc8f-648a9ff50d11&fp=967226427&cid=ma23578&mrk=239876506&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTY4NzI5MDIzOTA4NiIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiI1Ni44bWIiLCJoZWFwVCI6IjcyLjJtYiIsImZzdFBhaW50IjoiOTkzIiwiZmV0Y2hTIjoiMCIsImRvbWFpblMiOiIyIiwiZG9tYWluRSI6IjEzIiwiY29ublMiOiIxMyIsImNvbm5FIjoiNDkiLCJzc2xTIjoiMjkiLCJyZXF1UyI6IjQ5IiwicmVzcFMiOiI2NiIsInJlc3BFIjoiOTYiLCJkb21Mb2FkIjoiNzAiLCJkb21JbnRlciI6IjEzNTAiLCJkb21Mb2FkUyI6IjEzODAiLCJkb21Mb2FkRSI6IjE0MTUifSwiaWRlbnRpdGllcyI6W3sidHlwZSI6ImdhIiwiaWQiOiI2OTAxMDI5OTIiLCJyZWZUaW1lIjoiMTY4NzI5MDI0MjExNyJ9XSwiY2F0ZWdvcnkiOnsiY2F0ZWdvcmllcyI6W1siRW50ZXJ0YWlubWVudCIsIlRoaW5ncyBUbyBEbyJdXX0sImF1dGgwX3N1YiI6IiIsImF1ZGllbmNlIjpbeyJwcm92aWRlciI6InVzZXJEQiIsInNlZ21lbnRzIjpbIk1BVEhFUl9VOV9JTlNUQU5UQl8yMDIwMDIwMyJdLCJwYWdlSWQiOiI0NWZiYjA0OS1jZDRkLTQ1NDgtYjM0Mi0xYmQyZDk5NjA1NjcifSx7InByb3ZpZGVyIjoiaVNlZ3MiLCJzZWdtZW50cyI6WyJNQVRIRVJfVTlfSU5TVEFOVEJfMjAyMDAyMDMiXSwicGFnZUlkIjoiNDVmYmIwNDktY2Q0ZC00NTQ4LWIzNDItMWJkMmQ5OTYwNTY3In1dfQ
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:02 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
t
jadserve.postrelease.com/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ntv_mvi&us_privacy=1---
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.228.62.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-228-62-117.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
562c727492803b977118034f51a63502bd3ebcb6e7b7663ae73a8ca73b3cb1e1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:02 GMT
content-encoding
gzip
server
nginx/1.12.2
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
1451
expires
Mon, 1 Jan 1990 12:00:00 GMT
tag
s.thebrighttag.com/ 		14 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.thebrighttag.com/tag?site=t4tmU86&H=-2umnyqz
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.14.222.105 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-14-222-105.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
f67c1dae64731f037f0dcd7598af600024c9546bbdeed1c9f7185b027ef65bb4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:02 GMT
x-bt-requestid
cec88370-0fa2-11ee-864c-0000ac170070
server
nginx
etag
ea073f4c32be2f10a6117ca27c31b8e7
content-type
text/javascript
access-control-allow-origin
https://www.mercurynews.com
p3p
CP=NOI DSP COR NID
cache-control
private, must-revalidate
content-length
14502
expires
Thu, 01 Jan 1970 00:00:00 GMT
85e5807c-7cbe-44d7-9418-9c7fe8c952c1
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/85e5807c-7cbe-44d7-9418-9c7fe8c952c1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ Frame 1559 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 19:14:29 GMT
x-content-type-options
nosniff
age
347373
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20960
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:18:28 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 15 Jun 2024 19:14:29 GMT
7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v12/ Frame 1559 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs5.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 15 Jun 2023 07:34:32 GMT
x-content-type-options
nosniff
age
475770
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21144
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:43:23 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 14 Jun 2024 07:34:32 GMT
pr
s.amazon-adsystem.com/v3/ Frame 6C5D 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
48258a418142de5167fc5cf23d6bd09ecf33c56294a3775519c5897195100fca
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
4110
Content-Type
text/html;charset=ISO-8859-1
Date
Tue, 20 Jun 2023 19:44:02 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
13NXSV1ZDP1CVNYG2GNH
37cba71b-c7ee-4d11-a681-91a2e89763aa
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/37cba71b-c7ee-4d11-a681-91a2e89763aa
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
j
rp4.liadm.com/
Redirect Chain
  • https://rp.liadm.com/j?dtstmp=1687290242330&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-m...
  • https://rp4.liadm.com/j?dtstmp=1687290242330&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-...
48 B
587 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://rp4.liadm.com/j?dtstmp=1687290242330&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjEw&n3pc=true
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
3.227.221.232 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-221-232.compute-1.amazonaws.com
Software
/
Resource Hash
db1be639c6bb1d11edb8c716a629847c3e0f5492de69797d3619b34ddd34e878
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:02 GMT
x-pixel-event-id
3d3fd77b-19dc-4cd9-bc12-3535ec524db7
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
strict-transport-security
max-age=31536000; includeSubDomains
x-frame-options
DENY
vary
Origin
content-type
application/json
request-time
0
access-control-allow-origin
null
access-control-allow-credentials
true
trace-id
7309dfd05aa90ae1
content-length
48
x-xss-protection
1; mode=block

Redirect headers

date
Tue, 20 Jun 2023 19:44:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
x-frame-options
DENY
vary
Origin
location
https://rp4.liadm.com/j?dtstmp=1687290242330&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjEw&n3pc=true
access-control-allow-origin
https://www.mercurynews.com
request-time
0
access-control-allow-credentials
true
trace-id
0ebd1c17d9df7f35
content-length
0
x-xss-protection
1; mode=block
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
722 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:50:14 GMT
content-encoding
br
x-content-type-options
nosniff
age
3228
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
697
x-xss-protection
0
last-modified
Wed, 14 Jun 2023 09:18:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 20 Jun 2023 19:50:14 GMT
/
www.google.com/pagead/1p-user-list/11039244145/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/11039244145/?random=1687290241070&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1717658248&rmt_tld=0&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:02 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/11039244145/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/11039244145/?random=1687290241070&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1717658248&rmt_tld=1&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:02 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 6C5D
Redirect Chain
  • https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302918421454631000V10
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302918421454631000V10
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
HKN0PQAZQK2GGNZXDMCH
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:02 GMT
Server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302918421454631000V10
Content-Type
text/html
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
154
x-mnet-hl2
E
Expires
Tue, 20 Jun 2023 19:44:02 GMT
ecm3
s.amazon-adsystem.com/ Frame 6C5D
Redirect Chain
  • https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID
  • https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=95cec808
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=95cec808
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
W4P1TPKT8NEZAHAPYD75
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date
Tue, 20 Jun 2023 19:44:02 GMT
via
1.1 0146c8129cacdacca96753291cf27ec4.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
EWR53-P1
x-cache
FunctionGeneratedResponse from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=95cec808
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
mO7gBSNXIFL3yMogN_Qk55Ba9ARgFeyRC8qcB9YTB3rk6yQskMRvug==
/
geo.privacymanager.io/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://geo.privacymanager.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-61.ewr53.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
*
content-length
0
content-type
application/json
date
Tue, 20 Jun 2023 19:44:02 GMT
via
1.1 6fcb3966d0deb6baf3867f346443cb9a.cloudfront.net (CloudFront), 1.1 acbc1e922360be31edf0371abdc7a3a4.cloudfront.net (CloudFront)
x-amz-apigw-id
G1UsfHS7DoEFrmQ=
x-amz-cf-id
LCBdSYnuAX8ND-pDJUGURjR_cc0Gm3yrUEoMdsrWtrqG5nzD2cXcXQ==
x-amz-cf-pop
JFK51-C1 EWR53-P1
x-amzn-requestid
971f66a5-3697-4f81-9c59-7eb2751b4df3
x-cache
Miss from cloudfront
/
geo.privacymanager.io/ 		30 B
609 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://geo.privacymanager.io/
Requested by
Host: launchpad.privacymanager.io
URL: https://launchpad.privacymanager.io/1/launchpad.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-61.ewr53.r.cloudfront.net
Software
/
Resource Hash
70fd869f92915eb3c9f85d2d2b5a473ba45239ae463b35267642335337c46f06

Request headers

Accept
application/json
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 08:46:27 GMT
via
1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront), 1.1 acbc1e922360be31edf0371abdc7a3a4.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD89-C1, EWR53-P1
age
39455
x-amzn-requestid
dd44a638-d8a8-484c-abc5-1c3c4352137c
x-amzn-trace-id
Root=1-64916763-3fa25a584427deb858fb8853;Sampled=0;lineage=06620786:0
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type
application/json
access-control-allow-origin
*
x-cache
Hit from cloudfront
x-amz-apigw-id
Gz0XiGa7joEF2eQ=
content-length
30
x-amz-cf-id
ogCxGEbT4d5WifjJqjIq1ir2T-FNoiYAoGVAUJIPftNjErYzjXhvXw==
access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
gtm.js
www.googletagmanager.com/ 		225 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NFD2QGD&l=MG2DL
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d4743d01a4bb11d4b59fea90ab1973a8706d8c99ae2bdf5092540a6986bf2da0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:02 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
72856
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:44:02 GMT
UnitFeedManagerDesktop.min.js
vidstat.taboola.com/lite-unit/4.0.3/ 		111 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/lite-unit/4.0.3/UnitFeedManagerDesktop.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5d7c5d22a81ee3d27800eb5d20b5f160efb6cf98d51dd1f0cca7485442f2c5f4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:02 GMT
via
1.1 7c52af60a69f0ba536808e0cc2414994.cloudfront.net (CloudFront), 1.1 varnish
content-encoding
gzip
x-amz-cf-pop
YTO50-C2
age
297468
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront, HIT
content-length
31102
x-served-by
cache-yyz4535-YYZ
last-modified
Sat, 17 Jun 2023 09:04:57 GMT
server
AmazonS3
x-timer
S1687290243.735498,VS0,VE0
etag
"435321ac6c80e1f99bad06be26443aea"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
access-control-allow-headers
*
x-amz-cf-id
vKNUViUNuOdrXXu-41pIbRWm3DK6oDwwZdrAZwIUxjDhZrmZDN9u8w==
x-cache-hits
11423
abtests
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
363 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:US:V&tvi2=10443&lti=deflated&ri=9fe7195e4f75d53f1fd1573ee99538f0&sd=v2_c02de7af9faedacd62ff1bbad29e0f15_cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701_1687290241_1687290241_CNawjgYQtdRXGOvB19KNMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687290241259&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22block_clicks_init%22%2C%22type%22%3A%22block-clicks-manager%22%2C%22eventTime%22%3A1687290242746%7D&tim=19%3A44%3A02.746&id=2198&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:02 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
f89e1763-220d-4e09-ba69-9e040548fb7a.svg
cdn.taboola.com/static/f8/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/static/f8/f89e1763-220d-4e09-ba69-9e040548fb7a.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
39b076e4bb4fab9b8a142499cf6155f8c128464974691a04de7e764f71b72618

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
cMrDKn.emLmm9kiiOOF64ulDT4DRy6LK
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:02 GMT
x-amz-request-id
F8H6HDJE1731HG01
age
58
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
1758
x-amz-id-2
DvJTuate0p1Gm9O9YExEcSOw7muWZdQ+H4J6YuOBLeiipIYfLwIrRQWa80cGsvbs98/dAYPxn5Q=
x-served-by
cache-yyz4535-YYZ
last-modified
Wed, 07 Feb 2018 11:15:52 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290243.854696,VS0,VE0
etag
"b8b410e4b18d45aa2f3d9bc09cd335fb"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
abp
27
cache-control
private,max-age=31536000
accept-ranges
bytes
access-control-allow-headers
*
x-cache-hits
22
amzns2s
rtb.gumgum.com/usync/ Frame 2D82 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.234.8.191 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-234-8-191.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a328a83475f5479bdb8973a72516200628c68156e62085ffe830de768de194e5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html;charset=UTF-8
date
Tue, 20 Jun 2023 19:44:02 GMT
etag
W/"0834ebdab845259b8ec5e9f8e32610aee"
server
nginx
timing-allow-origin
*
usermatch
ssum-sec.casalemedia.com/ Frame 63E9
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
e6274310a5c0cfa834924a04b64dd415590f93c26e64ada9708371f7fac18394

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
1998
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
0
Keep-Alive
timeout=1, max=499
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache

Redirect headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:02 GMT
Expires
0
Keep-Alive
timeout=1, max=500
Location
/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
ecm3
s.amazon-adsystem.com/ Frame B93E
Redirect Chain
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4614819635623485669&gdpr=0&gdpr_consent=
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4614819635623485669&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
QR5PFBVFTC0XDRE49XKZ

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:02 GMT
location
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4614819635623485669&gdpr=0&gdpr_consent=
ecm3
s.amazon-adsystem.com/ Frame 00B7
Redirect Chain
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=5fa0069656320604&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&...
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAB5mRHm00XWQN-vi56AAAAAAA&expiration=1687376643&is_secure=true&gdpr=0
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAB5mRHm00XWQN-vi56AAAAAAA&expiration=1687376643&is_secure=true&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
4SQ848R25VEMFABM9HN8

Redirect headers

cache-control
no-cache, private, max-age=0, no-store
content-length
0
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
0
location
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAB5mRHm00XWQN-vi56AAAAAAA&expiration=1687376643&is_secure=true&gdpr=0
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
pragma
no-cache
server
nginx
/
match.sharethrough.com/jwumXNuB/v1/ Frame A6A9 		427 B
938 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.223.221.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-221-83.compute-1.amazonaws.com
Software
/
Resource Hash
c573dbd224f1dac44a6e38a48cf3c955c54429a419f792838ae57f6f318184bc

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-length
427
date
Tue, 20 Jun 2023 19:44:03 GMT
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 2390 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165951
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
tamptsync
sync-amz.ads.yieldmo.com/ Frame E366 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.208.104.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-208-104-226.compute-1.amazonaws.com
Software
/
Resource Hash
e99d6f426cab27b57376e9e3da4b0661152e865bfb401185de9296d90f56cfd1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers
Cache-Control, Pragma, *
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
*
content-encoding
gzip
content-type
text/html;charset=utf-8
date
Tue, 20 Jun 2023 19:44:03 GMT
pragma
no-cache
vary
accept-encoding
usync.html
eus.rubiconproject.com/ Frame A5A6 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:03 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
visitormatch
bh.contextweb.com/ Frame 77C0
Redirect Chain
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
828 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
2996fd08efe95bc991934e4be7708f059b0c7595e9410c883ae5385e9e174e7c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control
private, max-age=0, no-cache, no-store
content-language
en-CA
content-length
828
content-type
text/html;charset=iso-8859-1
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server
Jetty(10.0.14)
strict-transport-security
max-age=15768000

Redirect headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control
private, max-age=0, no-cache, no-store
content-language
en-CA
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
location
/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server
Jetty(10.0.14)
strict-transport-security
max-age=15768000
recommendations
a869.mercurynews.com/rest/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/rest/recommendations?storeId=0595003b-1825-43bc-89bd-9877ca21042f&profileId=53d732a1-8120-4fad-8c05-821f63a4cd3a&frequencyCap=8&itemId=9968021&request=%5B%7B%22id%22%3A1561661563872%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A03.012Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22SAME_CATEGORY%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%2C%7B%22value%22%3A3%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661593537%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A03.012Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22LOOK_ALIKE%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661645802%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A03.012Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22COLLABORATIVE_FILTERING%22%2C%22rampUp%22%3A%22INSTANT%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A1561661684113%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A03.012Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_CTR%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A%22default%22%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A03.012Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3Anull%7D%5D&&callback=bc_json826
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.113 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-113.jfk50.r.cloudfront.net
Software
- /
Resource Hash
f26f1bddadc6983f931a2de6e6365b4dc312b3df8cec9b011e88ed1b026a72ce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 b5fe18267507cb61755963d8928a60f4.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
4487
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
text/javascript;charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
x-amz-cf-id
d5HBSCecDuC4MW8Px_xruqpX4unQ1hB83mXSA2KunTemahG3qPDVOg==
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1687290241995&cv=11&fst=1687290241995&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=1333905033.1687290241&uamb=0&uaw=0&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b02a07342638ea98c3fbf00cd0288dc5f373ae024480bdedbb4e851d47a57ac5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1469
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
1060502780777063
connect.facebook.net/signals/config/ 		376 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1060502780777063?v=2.9.107&r=stable
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
7c46d9a954829d09583e3af58d09df0ab2773f37dc1e3ad593d382c2234fed47
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:44:03 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
109917
x-xss-protection
0
pragma
public
x-fb-debug
KIY/VqQRsu1D4nY1FgSFKmD1xMYhL7bQuKryg6N6PE/gAwLD670KBkxVAW7Sz5CCXLvCAVdazpHzhMMSlWiNdw==
x-fb-trip-id
1679558926
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
social
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/social?route=US:US:V&tvi2=10443&lti=deflated&ri=9fe7195e4f75d53f1fd1573ee99538f0&sd=v2_c02de7af9faedacd62ff1bbad29e0f15_cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701_1687290241_1687290241_CNawjgYQtdRXGOvB19KNMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687290241259&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%E2%80%99%20ex-Spotify%20exec%20tells%20BBC%22%2C%22sec%22%3A%22Entertainment%22%2C%22aut%22%3A%5B%22Martha%20Ross%22%5D%2C%22img%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1.jpg%3Fw%3D1024%22%2C%22v%22%3A15%2C%22pw%22%3Afalse%7D%5D%7D&tim=19%3A44%3A03.039&id=5772&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
baker
sli.mercurynews.com/ 		19 B
368 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sli.mercurynews.com/baker?dtstmp=1687290243071
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.33.238.169 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-33-238-169.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Tue, 20 Jun 2023 19:44:03 GMT
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
19
Content-Type
image/gif
syncframe
gum.criteo.com/ Frame ABEE 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:02 GMT
server
Kestrel
server-processing-duration-in-ticks
457945
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
a90899e84e5b40721594b8ba7517e0cd.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a90899e84e5b40721594b8ba7517e0cd.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
83ae7ba0370974e803fb70ffffd92deb797d08198ed6310e207ba7d75b72029e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a90899e84e5b40721594b8ba7517e0cd.jpeg
age
2442385
edge-cache-tag
485668035201530982018547323808119286028,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
485668035201530982018547323808119286028,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
HIT, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
107
req-referer
https://www.harpersbazaar.com/
content-length
17756
x-request-id
42dbadf70dd009b0df5585bf132a5dd7
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb804
x-served-by
cache-iad-kiad7000102-IAD, cache-iad-kcgs7200112-IAD, cache-chi-klot8100091-CHI, cache-iad-kiad7000063-IAD, cache-yyz4535-YYZ
last-modified
Fri, 05 May 2023 19:50:25 GMT
server
nginx
x-timer
S1687290243.130127,VS0,VE0
etag
"6ff1e84f0dafe001ea5f5047e2457782"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 0, 290, 4
9cc7eaf84d81d0a5a57cf79b8cf401f1.jpeg
images.taboola.com/taboola/image/fetch/h_212,w_380,c_fill,g_xy_center,x_720,y_557/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/h_212,w_380,c_fill,g_xy_center,x_720,y_557/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9cc7eaf84d81d0a5a57cf79b8cf401f1.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
168c5eaea7608001599828cc6f103ea4a659d4882b95a7cfdec2cd6ccb3330c3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/h_212,w_380,c_fill,g_xy_center,x_720,y_557/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9cc7eaf84d81d0a5a57cf79b8cf401f1.jpeg
age
1066015
edge-cache-tag
423741170203452711613019170260913585729,321778111551886336721786023298491166572,29ecf9b93bbf306179626feeda1fab70
cache-tag
423741170203452711613019170260913585729,321778111551886336721786023298491166572,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
229
expiration
expiry-date="Sun, 18 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.denverpost.com/
content-length
13350
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb204
x-served-by
cache-iad-kcgs7200085-IAD, cache-iad-kcgs7200144-IAD, cache-sna10722-LGB, cache-iad-kiad7000160-IAD, cache-yyz4535-YYZ
last-modified
Thu, 18 May 2023 04:52:35 GMT
server
nginx
x-timer
S1687290243.143613,VS0,VE0
etag
"d4ab21f9a33fa3c6e782b9324417a851"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 0, 0, 1431, 55
1791c9fa81a2a54a4641becd20be4b3e.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1791c9fa81a2a54a4641becd20be4b3e.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
8ef928fdfb8f3eeb4227af511515120e98219ce1326c45212eaecdad5cc8ae7a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1791c9fa81a2a54a4641becd20be4b3e.jpg
age
3062617
edge-cache-tag
402188373656136331886263197554274643949,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
402188373656136331886263197554274643949,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
94
expiration
expiry-date="Mon, 22 May 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://vnexpress.net/
content-length
6940
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kcgs7200130-IAD, cache-iad-kcgs7200160-IAD, cache-lga21943-LGA, cache-iad-kjyo7100167-IAD, cache-yyz4535-YYZ
last-modified
Fri, 21 Apr 2023 15:00:47 GMT
server
nginx
x-timer
S1687290243.143590,VS0,VE0
etag
"2e9f1731206ede56933eed232641c73e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1, 2980, 15
20ca3920796705f4e953bd5014720ea9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		33 KB
33 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/20ca3920796705f4e953bd5014720ea9.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dc262521a295b46a17eeb5d65d95bb8850fe237802a944c204c893b092e9ab76

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/20ca3920796705f4e953bd5014720ea9.jpg
age
3988702
edge-cache-tag
302935950058188571201508857327343714482,400943418252675406674416846973572213176,29ecf9b93bbf306179626feeda1fab70
cache-tag
302935950058188571201508857327343714482,400943418252675406674416846973572213176,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
134
expiration
expiry-date="Fri, 02 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://sandesh.com/
content-length
33284
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kiad7000087-IAD, cache-iad-kiad7000142-IAD, cache-chi-kigq8000101-CHI, cache-iad-kjyo7100087-IAD, cache-yyz4535-YYZ
last-modified
Tue, 02 May 2023 13:10:39 GMT
server
nginx
x-timer
S1687290243.144379,VS0,VE0
etag
"3ba80b38c80012f1c34078a6d6436c07"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 1, 151, 36
3b9c1aff23312afd0d184e0f54179765.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b9c1aff23312afd0d184e0f54179765.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ab381d8582319166d69ba8c745c6ad00999307d4aaed7116d93272764f604604

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b9c1aff23312afd0d184e0f54179765.jpg
age
5484065
edge-cache-tag
472722463543017882621331439693518864511,400943418252675406674416846973572213176,29ecf9b93bbf306179626feeda1fab70
cache-tag
472722463543017882621331439693518864511,400943418252675406674416846973572213176,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
246
req-referer
https://www.ynet.co.il/
content-length
18790
x-request-id
9dc8cf5e303a8dabbe0dc5968e07481c
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb203
x-served-by
cache-iad-kcgs7200148-IAD, cache-iad-kiad7000131-IAD, cache-lax10623-LGB, cache-iad-kjyo7100062-IAD, cache-yyz4535-YYZ
last-modified
Sun, 16 Apr 2023 19:54:24 GMT
server
nginx
x-timer
S1687290243.144367,VS0,VE0
etag
"151e9055f4c3189ca9ba53642e685f1c"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1, 4715, 10
93e7c6c4a868985cdb71cb3ccf707499.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/93e7c6c4a868985cdb71cb3ccf707499.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dd76966336047650cefcf04deb9fa6109be2943b6c5c5fae4ee733238ad6f281

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/93e7c6c4a868985cdb71cb3ccf707499.jpeg
age
3311318
edge-cache-tag
609363502349849483221139673788325806102,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
609363502349849483221139673788325806102,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
49
req-referer
http://www.espn.com/
content-length
15714
x-request-id
869152c016cc14f42d054a1dc1a1dea5
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kcgs7200073-IAD, cache-iad-kcgs7200176-IAD, cache-chi-klot8100179-CHI, cache-iad-kjyo7100076-IAD, cache-yyz4535-YYZ
last-modified
Thu, 11 May 2023 15:02:01 GMT
server
nginx
x-timer
S1687290243.144331,VS0,VE0
etag
"5c50962e3b89d112968a3dc54697395d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 3, 1, 1950, 171
bd1077109a793004d789267b56de3e3b.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		26 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bd1077109a793004d789267b56de3e3b.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
141edd521ee7dc499dfaaa8b9cebd09a7be6cba128d788b5a5388232eeabc462

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bd1077109a793004d789267b56de3e3b.jpg
age
511752
edge-cache-tag
529596858949551976325957996360154879293,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
529596858949551976325957996360154879293,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
117
req-referer
https://www1.folha.uol.com.br/
content-length
26506
x-request-id
6d76218e66f6b12c5df63e9780eb2e54
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kiad7000101-IAD, cache-iad-kiad7000091-IAD, cache-lga21967-LGA, cache-iad-kjyo7100073-IAD, cache-yyz4535-YYZ
last-modified
Thu, 25 May 2023 16:06:37 GMT
server
nginx
x-timer
S1687290243.161840,VS0,VE0
etag
"40e3a0665aff5f0cab6d04cba1f14d6f"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 432, 5
c6239d26c1081015da8050230fbf269b.jpg
images.taboola.com/taboola/image/fetch/h_212,w_380,c_fill,g_xy_center,x_362,y_230/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/h_212,w_380,c_fill,g_xy_center,x_362,y_230/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6239d26c1081015da8050230fbf269b.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ddfc7023909c96c0e99dbe50a4996729935a473233c33c555b8fbf3ab2ee3c84

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/h_212,w_380,c_fill,g_xy_center,x_362,y_230/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6239d26c1081015da8050230fbf269b.jpg
age
707765
edge-cache-tag
587356268005097457686237049894664356422,593926418681870691671074173605565287936,29ecf9b93bbf306179626feeda1fab70
cache-tag
587356268005097457686237049894664356422,593926418681870691671074173605565287936,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
81
expiration
expiry-date="Wed, 05 Jul 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.leedsallover.com/
content-length
22112
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb803
x-served-by
cache-iad-kjyo7100152-IAD, cache-iad-kiad7000058-IAD, cache-chi-klot8100052-CHI, cache-iad-kcgs7200115-IAD, cache-yyz4535-YYZ
last-modified
Sun, 04 Jun 2023 19:20:41 GMT
server
nginx
x-timer
S1687290243.172431,VS0,VE0
etag
"010062a068dabb08a700500d96dc19d0"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 162, 44
7dc0aea4532bf309c51ac8f89df3da08.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		26 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7dc0aea4532bf309c51ac8f89df3da08.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
153c4c5dacad490923052c36818d3ecf8f16bc73dd851020aa8b65351eb8004e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/7dc0aea4532bf309c51ac8f89df3da08.jpg
age
2526467
edge-cache-tag
335319669753286883398434858169056966590,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
335319669753286883398434858169056966590,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
254
expiration
expiry-date="Thu, 15 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.espn.com/
content-length
27046
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kiad7000024-IAD, cache-iad-kiad7000151-IAD, cache-sna10747-LGB, cache-iad-kcgs7200136-IAD, cache-yyz4535-YYZ
last-modified
Mon, 15 May 2023 12:40:22 GMT
server
nginx
x-timer
S1687290243.172418,VS0,VE0
etag
"4d60984f5b20ec755a7ff1bd0a7a820c"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 4, 1, 53, 2
bbd3ea2a3deb46e5998cba5a80cf3182.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bbd3ea2a3deb46e5998cba5a80cf3182.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
d0384208724718f4ce8f1e4c5a90a4261d7ec5c2e0197bdef1fc4c3281ac2d2d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
3
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bbd3ea2a3deb46e5998cba5a80cf3182.jpg
age
2963323
edge-cache-tag
434270000850537930009311514879257789769,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
434270000850537930009311514879257789769,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
353
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.panamaamerica.com.pa/
content-length
14788
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb201
x-served-by
cache-iad-kjyo7100082-IAD, cache-iad-kcgs7200140-IAD, cache-sna10725-LGB, cache-iad-kjyo7100140-IAD, cache-yyz4535-YYZ
last-modified
Thu, 11 May 2023 16:57:42 GMT
server
nginx
x-timer
S1687290243.172363,VS0,VE3
etag
"0d6ad249e4e25263ccb2d194e303708d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 8, 1, 4056, 1
2e4582162a4f44bc916c55b56b6acaac.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/2e4582162a4f44bc916c55b56b6acaac.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
753c16b10b576d7713f33741b0ebaefb88c05cf788a48b8e4f97ecbfec17c157

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/2e4582162a4f44bc916c55b56b6acaac.png
age
2608553
edge-cache-tag
398328884957708456217279721172870156213,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
398328884957708456217279721172870156213,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
55
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.daytondailynews.com/local/
content-length
18584
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb204
x-served-by
cache-iad-kjyo7100161-IAD, cache-iad-kiad7000103-IAD, cache-sna10726-LGB, cache-iad-kiad7000140-IAD, cache-yyz4535-YYZ
last-modified
Thu, 11 May 2023 15:02:00 GMT
server
nginx
x-timer
S1687290243.175590,VS0,VE0
etag
"050701ecc66efdc80f8344d65e66c896"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 5, 1, 2008, 7
851695b1724d6c11131c4e723b75c87e.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/851695b1724d6c11131c4e723b75c87e.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9d16f92ac1ebed546cb20a26bb1de836ed91b8ae6c61d655ddd998dc0a70f766

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/851695b1724d6c11131c4e723b75c87e.jpg
age
2794145
edge-cache-tag
586186681614894251528894898677702127897,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
586186681614894251528894898677702127897,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
HIT, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
123
req-referer
https://www.theblaze.com/st/Radio
content-length
8380
x-request-id
ef2a74c7e017fa0525cd205c195a5122
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb802
x-served-by
cache-iad-kjyo7100157-IAD, cache-iad-kcgs7200116-IAD, cache-chi-klot8100136-CHI, cache-iad-kjyo7100176-IAD, cache-yyz4535-YYZ
last-modified
Sat, 29 Apr 2023 19:58:31 GMT
server
nginx
x-timer
S1687290243.175905,VS0,VE0
etag
"a8299a7b12bff1b179174aa59b7cf0d5"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 0, 0, 2376, 2
30da433d-91a4-41e0-ab88-b066b982f836
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/30da433d-91a4-41e0-ab88-b066b982f836
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
137a52c8-d3a1-4ff9-872d-a4ce43bd22be
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/137a52c8-d3a1-4ff9-872d-a4ce43bd22be
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
a9b540fa-5562-4ac4-9263-d39d2a38d419
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/a9b540fa-5562-4ac4-9263-d39d2a38d419
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
5880bf14-fd4a-4761-b3b7-e0cbb9cf8a5c
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/5880bf14-fd4a-4761-b3b7-e0cbb9cf8a5c
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
d8d9fe042eb35785ca820adce0d4504c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d8d9fe042eb35785ca820adce0d4504c.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
752cb6627738044d241aea7470759409cd69b5d7d639d298b065ad601f304ca4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
4
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d8d9fe042eb35785ca820adce0d4504c.jpg
age
1240996
edge-cache-tag
372912748934979544711820844785966957671,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
372912748934979544711820844785966957671,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
428
req-referer
https://www.dinamalar.com/
content-length
5282
x-request-id
21bb398500a2abfe96f9d2bc609f4f82
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb803
x-served-by
cache-iad-kiad7000041-IAD, cache-iad-kcgs7200110-IAD, cache-chi-kigq8000102-CHI, cache-iad-kiad7000165-IAD, cache-yyz4535-YYZ
last-modified
Mon, 05 Jun 2023 03:00:46 GMT
server
nginx
x-timer
S1687290243.182658,VS0,VE4
etag
"f1a363c767120d8a9ad4e91d9bdd1e2d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 364, 1
dinitsync
crb.kargo.com/api/v1/ Frame A732 		0
435 B 		Document
General
Check archive.org
Download Go to
Full URL
https://crb.kargo.com/api/v1/dinitsync?partners=A9
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.210.26.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-210-26-99.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache, no-store, must-revalidate, private, max-age=0
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
Thu, 01 Jan 1970 00:00:00 UTC
Pragma
no-cache
Vary
Origin
X-Accel-Expires
0
ecm3
s.amazon-adsystem.com/ Frame AB86
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?id=1179662177681492769&ex=appnexus.com&gdpr=0
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?id=1179662177681492769&ex=appnexus.com&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
TH364H54CWGPNTZ8XJK2

Redirect headers

AN-X-Request-Uuid
27473f0f-efcd-4afb-8b71-809b6c4b3ef8
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=utf-8
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Location
https://s.amazon-adsystem.com/ecm3?id=1179662177681492769&ex=appnexus.com&gdpr=0
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
amazon
ce.lijit.com/beacon/ Frame B630
Redirect Chain
  • https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.86.50 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software
/
Resource Hash
0a5d910fd20b5c3d71577cf1ea50251764c9ad247e7bc15fdaa15dc2daafd541

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Encoding
gzip
Content-Length
448
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
Vary
Accept-Encoding, User-Agent
X-Sovrn-Pod
ad_ap2dca1

Redirect headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Location
https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
X-Sovrn-Pod
ad_ap2dca1
sync-iframe
cs-server-s2s.yellowblue.io/ Frame 50EB 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
466ec9b2f0df33cc46e00e0ab19347b6a0d5e0123fdd7809ff2c3d361eedbc0e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
cs-server-s2s.yellowblue.io
content-type
text/html
date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
x-envoy-upstream-service-time
7
ecm3
s.amazon-adsystem.com/ Frame 33C3
Redirect Chain
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3110826783617533917
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3110826783617533917
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
XMPSZ6754KKQ6HFYV6D0

Redirect headers

cache-control
no-cache, no-store, must-revalidate
content-length
0
date
Tue, 20 Jun 2023 19:44:03 GMT
location
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=3110826783617533917
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
integrator.js
adservice.google.com/adsid/ 		107 B
456 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		94 KB
18 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3515810653216537&correlator=2290022432688305&eid=31074948%2C31075339&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1%2Cinterstitial%2Ctop_leaderboard%2Coutstream_video%2Ccube1_rrail_atf&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F5%2C%2F0%2F1%2F2%2F3%2F6%2C%2F0%2F1%2F2%2F3%2F7%2C%2F0%2F1%2F2%2F3%2F8&prev_iu_szs=300x50%7C320x50%2C1x1%2C728x90%7C970x90%7C970x250%2C480x360%2C300x250%7C300x600%7C300x1050%7C160x600&ifi=1&adks=1140109686%2C3360478133%2C142133714%2C824671996%2C2052175676&didk=1622125026~356144529~303353385~359666826~302492128&sfv=1-0-40&prev_scp=pos%3DSponsorship_1%7Cpos%3Dinterstitial%7Cpos%3Dtop_leaderboard%7Cpos%3DOutstream_Video%7Cpos%3DCube1_RRail_ATF&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie_enabled=1&abxe=1&dt=1687290243204&lmt=1687290243&dlt=1687290239156&idt=1771&adxs=3085%2C1360%2C1636%2C1597%2C2338&adys=79%2C242%2C368%2C2605%2C874&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C0&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&msz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&fws=3076%2C1028%2C3076%2C1028%2C3076&ohw=1254%2C1%2C1280%2C711%2C304&ga_vid=690102992.1687290241&ga_sid=1687290243&ga_hid=1249931897&ga_fc=true&a3p=EhkKCnVpZGFwaS5jb20Y-b_X0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRieyNfSjTFIAFICCGoSGQoKcHViY2lkLm9yZxjZw9fSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y-b_X0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a998cb37a5d4bf74c2dfbb884499166a2d9db6e68b116f642005d37a03c470
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18395
x-xss-protection
0
google-lineitem-id
-1,-2,-1,-2,6159522902
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-1,-2,-1,-2,138413520352
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame AFB1 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Wed, 19 Jun 2024 19:44:03 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
trk.gif
jadserve.postrelease.com/ 		43 B
624 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_at=394&ntv_usid=7466784&ntv_pl=1028524
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.228.62.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-228-62-117.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/ 		43 B
624 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=a988ba17-f47b-4195-9e25-07f27d33e34b&ntv_fl=DOoEcgB0BB04DrHgiFrFsFF-lFdjD84Is_FOo9090IVUxII_D3Cj6ACXU9GQTCOJT9DRoCK65iH-PjvK-3eajYCBa0NoJhl4eOb6y2IwdvaTrWOCNcvyKHDWfEKdbzi9Xh65-dZeiY533qvOekM3R_ck3J56rEz1_NItqqGHnadRlT7jc6nQeS2TetqzKXlcG7ilkLzEujp2w_xRMh5nvufSN6Hxw-9Ue7ps87AY_4SoKvuWP5VuunANR9OSXvbqm64l0jaE9jeMRFVv0x2TYsfWtWn72ZesgI3WIO-1NUqDD1LmNAnuOh82z3qxJOxB7EmRZ9X87XZLeE245zKK8c2hl6D1evWzExBV-lKbiVeGa0iVu0GkmK8YViFOAd4SJVEIreGpIDvmV6ydb7yyZdaizMC9PJ09l2FD8F2GXlajOnds5woq3IT-_7Ic3zu2&ntv_ht=ggGSZAA&ntv_at=303,302&ntv_a=AAAAAAAAAAjRcRA&ord=1687290243255&ntv_it
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.228.62.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-228-62-117.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/ 		43 B
624 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=d6c0ef40-e8c7-44e9-8923-4d28147776ea&ntv_fl=w17_ozdxaJTnNoCtXGccc1C64zbwUBVS35TS0mkW_DnCA5mrN-dSNKXELM6tlYqT5AAy10HQFRSm9vS7H-gJ4TAZMRcp8wzPvhnSqzGrSiiTLRfnjVvewDL1z9BpTNzeWSBCn_wEW2xWOwM9BpDBd0FCVJP7NI_PRoMPiFYnnUQLhJld6yi5EtcPWv1RKiqUtqbZW6EDwWuGzZbx2yuWrbYzG9MH0jHtcmA0GLhATJlucla6QNDNawO8742EULCU5Aqva8QszYL6Cc1VqZjhge_2eLrmvLM7HyM4CQXEKspp8cT-Ggmo1qNIi4pQuVQGl8ZW8VCB7SJe8biDIt_AzFnkdoC39WAbHeUj9b3_uqjPd84qEacgU-BV-GzELpzeufOB21MbJUFJJQI15sgE0xQP8OlBMDR-H3-Dykos4ZENxEEP16D81718YQw5vIvI&ntv_ht=ggGSZAA&ntv_at=303&ntv_a=AAAAAAAAAArLEPA&ord=1687290243259&ntv_it
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.228.62.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-228-62-117.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
sync-container.js
b-code.liadm.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b-code.liadm.com/sync-container.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:23cb:9a00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 11:53:52 GMT
x-amz-version-id
WIo1DFPCLgnYZuB8yv1dFIDWe1bYBj2G
content-encoding
gzip
last-modified
Tue, 10 May 2022 11:48:07 GMT
server
AmazonS3
via
1.1 f577ca8c3771798c088df2efc06d2bc4.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P1
etag
W/"ae5e94de938b0387eda6df8f20da811a"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=2592000
age
1237811
x-amz-cf-id
xfwPunnLw_KYzDZNm8uJ_HegD-6AvkI8pCyqbPR9hTYE57wcbTfXMg==
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
  • https://usersync.gumgum.com/usersync?b=apn&i=1179662177681492769
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=apn&i=1179662177681492769
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Date
Tue, 20 Jun 2023 19:44:03 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
b7914eb6-19ac-4b40-a03d-391e90dcbbaf
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://usersync.gumgum.com/usersync?b=apn&i=1179662177681492769
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&gdpr=0&gdpr_consent=&us_privacy=
  • https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&gdpr=0&gdpr_consent=&us_privacy=
  • https://beacon.lynx.cognitivlabs.com/bidSwitch.gif?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://x.bidswitch.net/sync?dsp_id=425&user_group=1&expires=365&user_id=50113f91-7ace-4204-934b-46770b6d07a4&ssp=gumgum2&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://usersync.gumgum.com/usersync?b=bsw&i=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=bsw&i=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Location
//usersync.gumgum.com/usersync?b=bsw&i=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
Date
Tue, 20 Jun 2023 19:44:04 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=sta&i=0-72e8f41c-c614-5c44-7a44-34baa58f8010$ip$149.56.153.178
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=sta&i=0-72e8f41c-c614-5c44-7a44-34baa58f8010$ip$149.56.153.178
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Location
https://usersync.gumgum.com/usersync?b=sta&i=0-72e8f41c-c614-5c44-7a44-34baa58f8010$ip$149.56.153.178
Date
Tue, 20 Jun 2023 19:44:03 GMT
Connection
keep-alive
Content-Length
128
Content-Type
text/html; charset=utf-8
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
  • https://stags.bluekai.com/site/23178?id=7dYANMJyrp6NSRwK_hfM&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2N3ELFAU4TKKPFZHANSOKNJHOS27NBTE2
  • https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=7dYANMJyrp6NSRwK_hfM
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=7dYANMJyrp6NSRwK_hfM
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Content-Type
text/html; charset=utf-8
Location
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=7dYANMJyrp6NSRwK_hfM
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
103
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
  • https://usersync.gumgum.com/usersync?b=pln&i=VttZoBj38cya&ev=1&pid=558355
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=pln&i=VttZoBj38cya&ev=1&pid=558355
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
location
https://usersync.gumgum.com/usersync?b=pln&i=VttZoBj38cya&ev=1&pid=558355
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
cookie-sync
sync.outbrain.com/ Frame 2D82
Redirect Chain
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
  • https://usersync.gumgum.com/usersync?b=obn&i=ENC%28HIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&obuid=ENC(HIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz...
  • https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0
  • https://s.ad.smaato.net/c/?adExInit=o&redir=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dsmaato%26uid%3D%24UID%26obUid%3DHIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz%26gd...
  • https://sync.outbrain.com/cookie-sync?p=smaato&uid=95cec808&obUid=HIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz&gdpr=0&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=plat...
0
145 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.outbrain.com/cookie-sync?p=smaato&uid=95cec808&obUid=HIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz&gdpr=0&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
70.42.32.63 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:04 GMT
Cache-Control
no-cache
X-TraceId
4e90ceca2f9c98463e0425c50bf900db
Content-Length
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 0146c8129cacdacca96753291cf27ec4.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
EWR53-P1
x-cache
FunctionGeneratedResponse from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://sync.outbrain.com/cookie-sync?p=smaato&uid=95cec808&obUid=HIPzWcPqi6mVvS0htmHNUToO7KCJK0vODNuitEheoQxkeOa8Jk8hfjfrMtKU86Mz&gdpr=0&gdpr_consent=$CONSNT_STRING&us_privacy=$CCPA&initiator=platform
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
30f0WiJJZChjCHlB8FlY9Knh4NzPfylZFsH7laA0FACAA4GikDcdsQ==
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://usersync.gumgum.com/usersync?b=opx&i=cbb4f35f-fea3-4d69-b8db-562a48262f0e
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=opx&i=cbb4f35f-fea3-4d69-b8db-562a48262f0e
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:03 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://usersync.gumgum.com/usersync?b=opx&i=cbb4f35f-fea3-4d69-b8db-562a48262f0e
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=oth&i=y-V0bxrfdE2pf5kfcjU0BcOqdnzLDBVRMrd1TZ~A
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=oth&i=y-V0bxrfdE2pf5kfcjU0BcOqdnzLDBVRMrd1TZ~A
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:03 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://usersync.gumgum.com/usersync?b=oth&i=y-V0bxrfdE2pf5kfcjU0BcOqdnzLDBVRMrd1TZ~A
content-length
0
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync...
  • https://usersync.gumgum.com/usersync?b=vnt&i=880a98a2-e5e4-4836-b912-8db1e124443a
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=vnt&i=880a98a2-e5e4-4836-b912-8db1e124443a
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Location
https://usersync.gumgum.com/usersync?b=vnt&i=880a98a2-e5e4-4836-b912-8db1e124443a
Date
Tue, 20 Jun 2023 19:44:03 GMT
Connection
keep-alive
X-CI-RTID
44aae66e-4d40-4d26-bdad-862eeba040c7
Content-Length
108
Content-Type
text/html; charset=utf-8
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
  • https://usersync.gumgum.com/usersync?b=snc&i=568200899A48499D9AF846BF5A46F6A4
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=snc&i=568200899A48499D9AF846BF5A46F6A4
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish
server
nginx
age
0
access-control-allow-methods
POST,GET,HEAD,OPTIONS
x-varnish
531846667
location
https://usersync.gumgum.com/usersync?b=snc&i=568200899A48499D9AF846BF5A46F6A4
access-control-allow-origin
https://rtb.gumgum.com/
access-control-allow-credentials
true
content-length
0
142
match.deepintent.com/usersync/ Frame 2D82 		0
222 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
b /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:44:03 GMT
server
b
content-length
0
p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://usersync.gumgum.com/usersync?b=idi&i=5adef92e-e872-4286-a590-6f8c8cb526ab
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=idi&i=5adef92e-e872-4286-a590-6f8c8cb526ab
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

location
https://usersync.gumgum.com/usersync?b=idi&i=5adef92e-e872-4286-a590-6f8c8cb526ab
access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:03 GMT
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
usersync
usersync.gumgum.com/ Frame 2D82
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=sad&i=4614819635623485669
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=sad&i=4614819635623485669
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

location
https://usersync.gumgum.com/usersync?b=sad&i=4614819635623485669
date
Tue, 20 Jun 2023 19:44:03 GMT
content-length
0
ecm3
s.amazon-adsystem.com/ Frame 2D82 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
73KEJWENQTFYKSY2XQ8W
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 63E9
Redirect Chain
  • https://match.adsrvr.org/track/cmf/casale
  • https://match.adsrvr.org/track/cmb/casale?
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&expiration=1689882243&gdpr=0&gdpr_consent=
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&expiration=1689882243&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=498
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&expiration=1689882243&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
usermatchredir
ssum-sec.casalemedia.com/ Frame 63E9
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJIBgknqWgpSPnqrMo17egAADtAAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKa_mgT-DNgDy_HVokz8O9s&google_cver=1
43 B
766 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKa_mgT-DNgDy_HVokz8O9s&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=497
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEKa_mgT-DNgDy_HVokz8O9s&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
364
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dcm
s.amazon-adsystem.com/ Frame 63E9 		43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZJIBgknqWgpSPnqrMo17egAADtAAAAAB&gpp=&gpp_sid=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
AXYQ02YQV5EQKX36NY9G
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 63E9
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJIBgknqWgpSPnqrMo17egAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAAKOKRyT_pEOVlAljd9ZuI&google_cver=1
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAAKOKRyT_pEOVlAljd9ZuI&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=497
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAAKOKRyT_pEOVlAljd9ZuI&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum.casalemedia.com/ Frame 63E9
Redirect Chain
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
  • https://casale-match.dotomi.com/match/bounce/current?DotomiTest=132e08a4860f15d8&is_secure=true&networkId=19998&version=1
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAACIySjnRRLawMe994IAAAAAAA&expiration=1687376643&is_secure=true
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAACIySjnRRLawMe994IAAAAAAA&expiration=1687376643&is_secure=true
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAACIySjnRRLawMe994IAAAAAAA&expiration=1687376643&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
rum
dsum-sec.casalemedia.com/ Frame 63E9
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=ZJIBgwATV5hRfwBa
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJIBgwATV5hRfwBa&_test=ZJIBgwATV5hRfwBa
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJIBgwATV5hRfwBa&_test=ZJIBgwATV5hRfwBa
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

x-served-by
cache-yul12831-YUL
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687290244.528152,VS0,VE0
x-cache
HIT
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJIBgwATV5hRfwBa&_test=ZJIBgwATV5hRfwBa
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
crum
dsum-sec.casalemedia.com/ Frame 63E9
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
  • https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.ca...
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662097701423574
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662097701423574
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
cf-cache-status
DYNAMIC
x-function
209
server
cloudflare
x-reuse-index
571
content-type
text/html
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662097701423574
p3p
CP="NOI DEVo TAIa OUR BUS"
cache-control
no-cache, private
cf-ray
7da681169eac33fb-YUL
alt-svc
h3=":443"; ma=86400
expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 63E9
Redirect Chain
  • https://secure.adnxs.com/getuid?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=$UID
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=1179662177681492769
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=1179662177681492769
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

Date
Tue, 20 Jun 2023 19:44:03 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
5e70f448-7f67-45ae-bf70-34a127522076
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=46&external_user_id=1179662177681492769
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 63E9 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
N67CX5WCEY9VJGQ5SWVE
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame 77C0
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=azIwV1ZKRGl4X3lpWk5oM0haREVmZw&gdpr=0&gdpr_consent=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEGPuUHjqtKix2YVOu27mPRk&google_cver=1
49 B
813 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEGPuUHjqtKix2YVOu27mPRk&google_cver=1
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Protocol
H2
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://bh.contextweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
content-type
image/gif;charset=iso-8859-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEGPuUHjqtKix2YVOu27mPRk&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
335
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame 77C0
Redirect Chain
  • https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid=
  • https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=5930cb5c4e515d8&is_secure=true&networkId=14200&version=1&nuid=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAHwrPka_LWIgNQwSkJAAAAAAA&expiration=1687376643&nuid=&is_secure=true
49 B
841 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAHwrPka_LWIgNQwSkJAAAAAAA&expiration=1687376643&nuid=&is_secure=true
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Protocol
H2
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://bh.contextweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
content-type
image/gif;charset=iso-8859-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAHwrPka_LWIgNQwSkJAAAAAAA&expiration=1687376643&nuid=&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
ecm3
s.amazon-adsystem.com/ Frame 77C0 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=VttZoBj38cya&ex=Pulsepoint
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://bh.contextweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
M2FHDGZCB3FS0RSHV59M
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame A5A6 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:03 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 03:39:20 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=28517
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 03:39:20 GMT
bat.js
bat.bing.com/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 20 Jun 2023 19:44:02 GMT
last-modified
Thu, 11 May 2023 18:08:27 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 00B6B8B8DCA94007A7087E842F6AC719 Ref B: YMQ01EDGE0414 Ref C: 2023-06-20T19:44:03Z
etag
"80df77953384d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12183
ecm3
s.amazon-adsystem.com/ Frame A6A9 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=35620282-96f1-466f-b370-6daf818c9a83
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
CSH58J1AK3BWHV42KTP8
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
v1
match.sharethrough.com/sync/ Frame A6A9
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
68 B
608 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.223.221.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-221-83.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
v1
match.sharethrough.com/sync/ Frame A6A9
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
68 B
607 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.223.221.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-221-83.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
v1
match.sharethrough.com/sync/ Frame A6A9
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
68 B
608 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.223.221.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-221-83.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
v1
match.sharethrough.com/sync/ Frame A6A9
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
  • https://secure.adnxs.com/getuid?https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=$UID
  • https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1179662177681492769
68 B
603 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1179662177681492769
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.223.221.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-221-83.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

Date
Tue, 20 Jun 2023 19:44:03 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
8447fcad-d7d3-41bc-a65f-0db8af5cf04b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://match.sharethrough.com/sync/v1?source_id=0e8893f90b606c9c5d33f1be&gdpr=0&gdpr_consent=&source_user_id=1179662177681492769
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame E366 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=gb63ffdf5e8844fc2dd8&gdpr=0
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
7H92GMGG74P4Y1VHWWZH
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
ads.yieldmo.com/v000/ Frame E366
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c
  • https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEL66ASCQJ_Y4vrCm-P3-keo&google_cver=1
43 B
471 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEL66ASCQJ_Y4vrCm-P3-keo&google_cver=1
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
44.207.246.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-207-246-26.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESEL66ASCQJ_Y4vrCm-P3-keo&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
299
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
ads.yieldmo.com/v000/ Frame E366
Redirect Chain
  • https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an
  • https://ads.yieldmo.com/v000/sync?userid=1179662177681492769&pn_id=an
43 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?userid=1179662177681492769&pn_id=an
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
44.207.246.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-207-246-26.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

Date
Tue, 20 Jun 2023 19:44:03 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
a9c82fa4-dadc-45ac-b5c6-6d14de0c0ff5
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://ads.yieldmo.com/v000/sync?userid=1179662177681492769&pn_id=an
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ImgSync
image8.pubmatic.com/AdServer/ Frame E366
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
0
39 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.yieldmo.com%252Fsync%253Fpn_id%253Dpub%2526id%253D%2523PMUID%2526gdpr%253DPM_GDPR%2526gdpr_consent%253DPM_CONSENT&rdf=1
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
content-length
0

Redirect headers

location
/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.yieldmo.com%252Fsync%253Fpn_id%253Dpub%2526id%253D%2523PMUID%2526gdpr%253DPM_GDPR%2526gdpr_consent%253DPM_CONSENT&rdf=1
date
Tue, 20 Jun 2023 19:44:01 GMT
content-length
327
content-type
text/html; charset=utf-8
sync
ads.yieldmo.com/v000/ Frame E366
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&redir%3Dhttps%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3D%5BRX_UUID%5D
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&zcc=1&cb=1687290243519
  • https://ad.turn.com/r/cs?pid=45&rndcb=8271417778
  • https://sync.1rx.io/usersync/turn/8529793602827949306?dspret=1&gdpr=&gdpr_consent=&us_privacy=
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3DRX-64d977bf-a2a9-423a-8d0b-404f4e0c59...
  • https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
43 B
698 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
44.207.246.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-207-246-26.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

Location
https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Date
Tue, 20 Jun 2023 19:44:04 GMT
Content-Type
text/html
Connection
keep-alive
ETag
RX64d977bfa2a9423a8d0b404f4e0c5937005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
receive
pixel.tapad.com/idsync/ex/ Frame E366
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3107&partner_device_id=gb63ffdf5e8844fc2dd8
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=76c19607-052e-43a5-b5b2-1d6cfe831e64%252C%252C&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&ttd_puid=76c19607-052e-43a5-b5b2-1d6cfe831e64%2C%2C
95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&ttd_puid=76c19607-052e-43a5-b5b2-1d6cfe831e64%2C%2C
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H3
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&ttd_puid=76c19607-052e-43a5-b5b2-1d6cfe831e64%2C%2C
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
359
jfy5yp77cohy74fsw5uk.mp4
cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/ 		67 KB
67 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/jfy5yp77cohy74fsw5uk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5af7f54e4682da1be1484f658f9b15a84537085a4081cef229704a6d8e4ceb71

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
JhpPlUz7nZ57ILPZKofZM6pneMKKR0I4
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish
x-amz-request-id
BV32PXSKRRZVDTTS
age
102
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-68339/68340
x-amz-replication-status
COMPLETED
Content-Length
68340
x-amz-id-2
lZibJyPYpGrcXPFMgc3IsqbDj5sOc3pWGbNxM/NqLRY9Chh1T94tQP+JDjdkJYwToOYsKIQVC9I=
x-served-by
cache-yyz4535-YYZ
last-modified
Fri, 03 Feb 2023 08:45:58 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290243.301742,VS0,VE0
etag
"12d66db772be5305a2eda235f0b44b99"
content-type
video/mp4;codecs=avc1
abp
70
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
3003922
ae0ue1jbcjqu5byivgsm.mp4
cdn.taboola.com/libtrc/static/video/v1682562179/ 		463 KB
463 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1682562179/ae0ue1jbcjqu5byivgsm.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
03d9c6282533912a324c1d6f7c0c06583bed3f2c3a4a2331a6c36df3602faf52

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
1kIG7nplrGZPIHeqvx4bs.wW29YRS385
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish
x-amz-request-id
YWDZB70JFPTV4TSV
age
81
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-474042/474043
x-amz-replication-status
COMPLETED
Content-Length
474043
x-amz-id-2
sPWoV9t/5jiGI9xHumsxNDWayxqWz79zv3wbXlBPbLyOwWyT+D6/oviy0FeJCjgYC3UQkKgZtx4=
x-served-by
cache-yyz4535-YYZ
last-modified
Thu, 27 Apr 2023 02:23:05 GMT
server
AmazonS3
x-timer
S1687290243.302068,VS0,VE1
etag
"f3a359ea66d151486ab4c08935a18108"
content-type
video/mp4;codecs=avc1
abp
25
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
apioyas5ui0dh2xpewrm.mp4
cdn.taboola.com/libtrc/static/video//w_600,c_scale/v1666981579/ 		466 KB
466 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video//w_600,c_scale/v1666981579/apioyas5ui0dh2xpewrm.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1cfd94e29569cdb86e0af17ba81d1ee4afb420ec526807697af20dc923f1a52e

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
sOf42BKddYCcuAA6EkKkJIfpYyEuQ2.G
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish
x-amz-request-id
SG97S4QFX9DC5EVM
age
78
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-476901/476902
x-amz-replication-status
COMPLETED
Content-Length
476902
x-amz-id-2
C54XUUBP1qcdKBkapkHwqwVrCUxwWDLk+La+McMnydUyOLv5hiDSMQU/XZAc6QVqgV5R6tMJ6gg=
x-served-by
cache-yyz4535-YYZ
last-modified
Fri, 28 Oct 2022 18:26:28 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290243.301742,VS0,VE2
etag
"edfd9f1ac54fbee9c56f02110ac8b8f5"
content-type
video/mp4;codecs=avc1
abp
81
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
cktcnyyudrurusyfjouk.mp4
cdn.taboola.com/libtrc/static/video/v1685950230/ 		1 MB
1 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1685950230/cktcnyyudrurusyfjouk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7a6e593f715545a4262c0d9a90d157b6b18ae0900ca6ddf3c6d568134310fc2f

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
d6ueGktFcB2EwN7zocuabc2gAAuw1YPA
date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 varnish
x-amz-request-id
C4NX8W6QGYMSVYSQ
age
11
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-1248084/1248085
x-amz-replication-status
COMPLETED
Content-Length
1248085
x-amz-id-2
jrobY0g2BRiVVJDVVxwdHK6sjsQcWsM5DsbJyKNkEp10Wwcs5NdGBRdBZYPiatSyYr6Ew07DItg=
x-served-by
cache-yyz4535-YYZ
last-modified
Mon, 05 Jun 2023 07:30:39 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290243.306923,VS0,VE1
etag
"e73e901218df8f12f0d31914663c3397"
content-type
video/mp4;codecs=avc1
abp
83
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
cs
cs-server-s2s.yellowblue.io/ Frame 50EB
Redirect Chain
  • https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X
  • https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212190061405193
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212190061405193
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:02 GMT
referrer-policy
unsafe-url
server
33XP004
x-33x-status
100000000008200000C
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212190061405193
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
cs
cs-server-s2s.yellowblue.io/ Frame 50EB
Redirect Chain
  • https://csync.loopme.me/?pubid=11362&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11571%26id%3D%7Bdevice_id%7D
  • https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
date
Tue, 20 Jun 2023 19:44:03 GMT
server
_
content-length
0
cksync.php
contextual.media.net/ Frame 50EB 		61 B
459 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=25&type=ris&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11585%26id%3D%3Cvsid%3E
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.204.23 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-36-204-23.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:03 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
61
x-mnet-hl2
E
expires
Tue, 20 Jun 2023 19:44:03 GMT
cs
cs.yellowblue.io/ Frame 50EB
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=
  • https://cs.yellowblue.io/cs?aid=11601&id=52cb64774129a9aa101be8ca6e9d9d3&gdpr_consent=&gdpr=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11601&id=52cb64774129a9aa101be8ca6e9d9d3&gdpr_consent=&gdpr=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
nginx
Access-Control-Allow-Origin
*
Location
https://cs.yellowblue.io/cs?aid=11601&id=52cb64774129a9aa101be8ca6e9d9d3&gdpr_consent=&gdpr=0
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
x-sticky-vk
1687290243541001-147
cs
cs-server-s2s.yellowblue.io/ Frame 50EB
Redirect Chain
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
  • https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=b906d225-1d58-4500-8893-66f3b5de01e6
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=b906d225-1d58-4500-8893-66f3b5de01e6
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Location
https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=b906d225-1d58-4500-8893-66f3b5de01e6
Date
Tue, 20 Jun 2023 19:44:03 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
cs
cs-server-s2s.yellowblue.io/ Frame 50EB
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11596%26id%3D$UID&gdpr=0&gdpr_consent=
  • https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=1179662177681492769&gdpr=0&gdpr_consent=
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=1179662177681492769&gdpr=0&gdpr_consent=
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Date
Tue, 20 Jun 2023 19:44:03 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
658aabfc-8e80-4f3a-a73a-bdd07f3432e1
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=1179662177681492769&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cs
cs.yellowblue.io/ Frame 50EB
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent=
  • https://cs.yellowblue.io/cs?aid=11587&uid=35620282-96f1-466f-b370-6daf818c9a83&gdpr=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11587&uid=35620282-96f1-466f-b370-6daf818c9a83&gdpr=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs.yellowblue.io/cs?aid=11587&uid=35620282-96f1-466f-b370-6daf818c9a83&gdpr=0
date
Tue, 20 Jun 2023 19:44:03 GMT
content-length
0
cs
cs.yellowblue.io/ Frame 50EB
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent=
  • https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent=&verify=true
  • https://cs.yellowblue.io/cs?aid=11591&id=y-GBn6EsNE2uJwaSvumh901S2KVPmsEqlX~A&gdpr_in_effect=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11591&id=y-GBn6EsNE2uJwaSvumh901S2KVPmsEqlX~A&gdpr_in_effect=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs.yellowblue.io/cs?aid=11591&id=y-GBn6EsNE2uJwaSvumh901S2KVPmsEqlX~A&gdpr_in_effect=0
date
Tue, 20 Jun 2023 19:44:03 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
cs
cs-server-s2s.yellowblue.io/ Frame 50EB
Redirect Chain
  • https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D115667%26uid%3D%5BUID%5D
  • https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=7f6700ef-9efd-41da-8a71-72c3ea800d51
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=7f6700ef-9efd-41da-8a71-72c3ea800d51
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
go-iad-2-5-83
Content-Type
text/plain; charset=utf8
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=7f6700ef-9efd-41da-8a71-72c3ea800d51
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
cs
cs-server-s2s.yellowblue.io/ Frame 50EB
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D
  • https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=d4894bb9-0159-487a-94e7-1a55a1dffa0b
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=d4894bb9-0159-487a-94e7-1a55a1dffa0b
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:03 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=d4894bb9-0159-487a-94e7-1a55a1dffa0b
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
ImgSync
image8.pubmatic.com/AdServer/ Frame 50EB
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&rdf=1
0
39 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&rdf=1
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
content-length
0

Redirect headers

location
/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&rdf=1
date
Tue, 20 Jun 2023 19:44:02 GMT
content-length
172
content-type
text/html; charset=utf-8
ecm3
s.amazon-adsystem.com/ Frame 50EB 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rise.com&id=1Y0qRO6akf_s
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
AA4YE7CP0WMVND6K16J4
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
user-sync
sync.adkernel.com/ Frame 4703 		22 B
192 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software
nginx /
Resource Hash
4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Age
0
Cache-Control
no-store
Connection
close
Content-Length
22
Date
Tue, 20 Jun 2023 19:44:03 GMT
Pragma
no-cache
Server
nginx
e9d4ff858b5e32317e843f5ed11b2659.gif
cs.iqzone.com/ Frame 02B8 		9 B
175 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.2.111.13 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software
nginx /
Resource Hash
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Type
text/plain
Date
Tue, 20 Jun 2023 19:44:07 GMT
Server
nginx
Transfer-Encoding
chunked
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame AD44 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165951
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
usersync
usersync.gumgum.com/ Frame E584
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=ttd&i=59f17c06-c5d2-4b1e-89aa-3d64ff091022
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=ttd&i=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
0
Pragma
no-cache

Redirect headers

cache-control
private,no-cache, must-revalidate
content-length
193
content-type
text/html
date
Tue, 20 Jun 2023 19:44:03 GMT
location
https://usersync.gumgum.com/usersync?b=ttd&i=59f17c06-c5d2-4b1e-89aa-3d64ff091022
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
usersync
usersync.gumgum.com/ Frame F512
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
  • https://usersync.gumgum.com/usersync?b=mmh&i=c0d66492-0183-4f00-930f-e67415c7188d&gdpr=0&gdpr_consent=
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=mmh&i=c0d66492-0183-4f00-930f-e67415c7188d&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
0
Pragma
no-cache

Redirect headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
Tue, 20 Jun 2023 19:44:02 GMT
Keep-Alive
timeout=360
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
MT3 1031 59fd23a master iad iad-pixel-x22 config_version:"1969"
location
https://usersync.gumgum.com/usersync?b=mmh&i=c0d66492-0183-4f00-930f-e67415c7188d&gdpr=0&gdpr_consent=
sid
mug.criteo.com/ Frame ABEE
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=mercurynews.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=lHABFnw1NmM5MmdSR3R0ZEVyZ3B1d2p4N09VeWMxMEphYXlxTnk4a1hBc1NVWlJEeWlJYWFPWWRFaDExQXJUa3Q4NmZWeWRRbXdLQWZ5Rjg0TWhnSm9KMjJBSVBPVGQrcWZBbmZReU55NTI1QmpJUUo1cElTY3d1RTkyUz...
452 B
658 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=lHABFnw1NmM5MmdSR3R0ZEVyZ3B1d2p4N09VeWMxMEphYXlxTnk4a1hBc1NVWlJEeWlJYWFPWWRFaDExQXJUa3Q4NmZWeWRRbXdLQWZ5Rjg0TWhnSm9KMjJBSVBPVGQrcWZBbmZReU55NTI1QmpJUUo1cElTY3d1RTkyUzVCQzlzanhwLzExTjVaR2NuNkdjanorLy9oZUtZbDFPZ2JvR1JmOXFhUU9jMlR4WFV1aTNoSUNTSnNuTGtFU285aHlzc0ZZVFppTk9iSGtFOHBqSk1DeWJDNVlHcmVEcnJZbVAzdUNhK05Bb2IxUzQvc1AycEdJZDJMUUVaMzRheTRJZzRjVCtzazFBWjIzZElMNXU3ayttSWdsL3RxZz09fA&cppv=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
80d5d83d402cf42a5ae0ef1758e705922e67a9dcd4853314f68da63b7194aafb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:02 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2119516
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:02 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=lHABFnw1NmM5MmdSR3R0ZEVyZ3B1d2p4N09VeWMxMEphYXlxTnk4a1hBc1NVWlJEeWlJYWFPWWRFaDExQXJUa3Q4NmZWeWRRbXdLQWZ5Rjg0TWhnSm9KMjJBSVBPVGQrcWZBbmZReU55NTI1QmpJUUo1cElTY3d1RTkyUzVCQzlzanhwLzExTjVaR2NuNkdjanorLy9oZUtZbDFPZ2JvR1JmOXFhUU9jMlR4WFV1aTNoSUNTSnNuTGtFU285aHlzc0ZZVFppTk9iSGtFOHBqSk1DeWJDNVlHcmVEcnJZbVAzdUNhK05Bb2IxUzQvc1AycEdJZDJMUUVaMzRheTRJZzRjVCtzazFBWjIzZElMNXU3ayttSWdsL3RxZz09fA&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
467496
content-length
0
expires
0
d1754b5a-24ba-4b2a-86bc-e425616352d7
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/d1754b5a-24ba-4b2a-86bc-e425616352d7
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
usync.html
eus.rubiconproject.com/ Frame 66CE
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:03 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Tue, 20 Jun 2023 19:44:03 GMT
location
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
server
AkamaiGHost
/
onetag-sys.com/usync/ Frame 2FC7 		2 KB
815 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.222.39.184 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip184.ip-51-222-39.net
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
collect
www.google-analytics.com/j/ 		4 B
24 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=1249931897&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&dr=&dp=%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBACEAjBAAAACgFK~&jid=2107558941&gjid=119770983&cid=690102992.1687290241&tid=UA-61435456-5&_gid=1597915438.1687290241&_r=1&_slc=1&gtm=45He36e0n71TLFP4R&cd2=mercurynews.com&cd3=mercurynews.com&cd4=&cd5=2023-06-20T11%3A12%3A40-07%3A00&cd6=2023-06-20T11%3A12%3A40-07%3A00&cd7=2023-06-20T11%3A52%3A17-07%3A00&cd9=no&cd10=Entertainment&cd11=6.2.2&cd12=&cd13=WP&cd14=Entertainment&cd15=Entertainment&cd16=Things%20To%20Do&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&cd22=meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&cd23=9968021&cd24=article&cd25=BANG&cd26=Martha%20Ross&cd27=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%27%20ex-Spotify%20exec%20tells%20BBC&cd28=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&cd29=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%27%20ex-Spotify%20exec%20tells%20BBC&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=BayAreaNewsGroup&cd34=true&cd35=&cd36=5021&cd37=801&cd38=Martha%20Ross&cd42=Not%20Set&cd49=false&cd50=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&cd51=&cd54=no_email&cd55=Bay%20Area%20News%20Group&cd61=Not%20Set&cd62=free&cd63=Not%20Set&cd64=Entertainment%2CThings%20To%20Do&cd65=The%20Mercury%20News&cd53=690102992.1687290241&z=705184597
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
usersync
usersync.gumgum.com/ Frame 4AD6
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=atm&i=ZJIBgwATV5hRfwBa&gdpr=0&gdpr_consent=
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=atm&i=ZJIBgwATV5hRfwBa&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
0
Pragma
no-cache

Redirect headers

accept-ranges
bytes
cache-control
no-cache
content-length
0
date
Tue, 20 Jun 2023 19:44:03 GMT
location
https://usersync.gumgum.com/usersync?b=atm&i=ZJIBgwATV5hRfwBa&gdpr=0&gdpr_consent=
pragma
no-cache
retry-after
0
server
Varnish
via
1.1 varnish
x-cache
HIT
x-cache-hits
0
x-served-by
cache-yul12831-YUL
x-timer
S1687290243.472319,VS0,VE0
pixel
cm.g.doubleclick.net/ Frame D952 		170 B
243 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV9hNGEyMmM2My0wMzQ5LTRjODYtOGFlOC05NWVjNmMzM2ZiMDk=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
170
content-type
image/png
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
server
HTTP server (unknown)
x-xss-protection
0
usersync
usersync.gumgum.com/ Frame 7932
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=gumgum
  • https://usersync.gumgum.com/usersync?b=sus&i=ZJIBg8Co8YQAAMZ2WjUAAAAA
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=sus&i=ZJIBg8Co8YQAAMZ2WjUAAAAA
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:04 GMT
Expires
0
Pragma
no-cache

Redirect headers

Cache-Control
private
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:03 GMT
Location
https://usersync.gumgum.com/usersync?b=sus&i=ZJIBg8Co8YQAAMZ2WjUAAAAA
P3P
CP="See also http://www.scaleout.jp/privacy/"
Server
nginx
X-SO-Ads-Time
2
X-SO-Cluster-ID
0
X-SO-HostName
a-ad40367.dc2p.scaleout.jp
X-SO-IP
149.56.153.178
X-SO-Key
ZJIBg8Co8YQAAMZ2WjUAAAAA
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"149.56.153.178","key":"ZJIBg8Co8YQAAMZ2WjUAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"a-ad40367"}
X-SO-LB-Hostname
m-tgng32.dc4p.scaleout.jp
X-SO-Upstream-ID
a-ad40367
gumgum
cs.admanmedia.com/sync/ Frame ABFA 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.admanmedia.com/sync/gumgum?puid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=&ccpa=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
80.77.87.161 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options DENY

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:03 GMT
Server
nginx
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
X-Frame-Options
DENY
usermatchredir
ssum-sec.casalemedia.com/ Frame 7A6D 		43 B
766 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
0
Keep-Alive
timeout=1, max=498
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
usersync
usersync.gumgum.com/ Frame F993
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=gumgum
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1
  • https://usersync.gumgum.com/usersync?b=rth&i=2LK2FelB5bz5w6flSs8Z&pi=gumgum&tc=1
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=rth&i=2LK2FelB5bz5w6flSs8Z&pi=gumgum&tc=1
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:03 GMT
Expires
0
Pragma
no-cache

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:03 GMT Tue, 20 Jun 2023 19:44:03 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://usersync.gumgum.com/usersync?b=rth&i=2LK2FelB5bz5w6flSs8Z&pi=gumgum&tc=1
pragma
no-cache
usync.html
eus.rubiconproject.com/ Frame BC82
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
  • https://eus.rubiconproject.com/usync.html?p=gumgum
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:03 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Tue, 20 Jun 2023 19:44:03 GMT
location
https://eus.rubiconproject.com/usync.html?p=gumgum
server
AkamaiGHost
feed-card-placeholder.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/feed-card-placeholder.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
24999918b7aa7fd5adeca29162085186c3e7cdee5914709c9a927b46b48f05b9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
oTtQuzux.d8yESyUrbo6rF4NhK8d4BsH
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:03 GMT
x-amz-request-id
6FY2QVWW6XTC1PWX
age
33612
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1262
x-amz-id-2
FeLCIAUPIb0vtpgwlnSu2kYmpG1S/P6ryJCZbUK6lE4O1pn0uumfqTf2Q3/0mO8jWCuqIwQZRqU=
x-served-by
cache-yyz4535-YYZ
last-modified
Tue, 20 Jun 2023 10:23:52 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290244.516381,VS0,VE0
etag
"b47e6d8318effa2404d0ccb9a7394d61"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
24
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
14610
userx.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/userx.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ef13b0253a986d36b9de961b9d657b6735fc409299b451d1e9a1454f66ce2fec

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
yQwZyXEurRH1ow5V_7vo0gyZObwynie6
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:03 GMT
x-amz-request-id
3ZG1VF39CSQC2YMA
age
33585
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
5397
x-amz-id-2
080MaH408IKBPSxQ4fZO7oXinpMbkUIv0Dhb6LM6gJdlwqfowbCHtmDxKjw3fgDaOvt/9aDaJKw=
x-served-by
cache-yyz4535-YYZ
last-modified
Tue, 20 Jun 2023 10:24:18 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290244.520384,VS0,VE0
etag
"b7cdca876844e9766f1112d8bd36fb5d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
80
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
5497
article-detection.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/article-detection.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
31c86114d8c9683bade57e627634f040284e99a601deb292b961108e5d831415

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
4H3kMWXEvjq2NgzTAQGAVlKPfHF0V_uV
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:03 GMT
x-amz-request-id
DA5TM8P8MFWRY7SD
age
33624
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1235
x-amz-id-2
CsFz6gPcU0NAyosTpIUS3B7zYDf5yCFL14KGfGK743Rghk50ZMQYSwJYVFrrtc5GB9ZEqdGtB9o=
x-served-by
cache-yyz4535-YYZ
last-modified
Tue, 20 Jun 2023 10:23:40 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290244.525486,VS0,VE0
etag
"1f20295bd8365ddf48f735c926ff0cc2"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
98
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
17418
distance-from-article.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/distance-from-article.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
136a576886a9ae3b5d55278a3e69a1fcc0a2189dfbf77ec41787742f260e5526

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
tiKXD9R.iV6EIW70tY.NUChNLGxA7YrV
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:03 GMT
x-amz-request-id
KWZR0RHK8XV795VC
age
33617
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1134
x-amz-id-2
zSRJOBoBRIuxJGt4wbmR38KyCYdxt2T7tCbvBJ47iMdYqXXh33yl3ZaBHCMj3ny9vqCxwzQSASg=
x-served-by
cache-yyz4535-YYZ
last-modified
Tue, 20 Jun 2023 10:23:47 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290244.525626,VS0,VE0
etag
"fbfd48aada1c3f9df380e1a033c23ef4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
13
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
17430
ecm3
s.amazon-adsystem.com/ Frame B630 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=G2VgiPZHAzppHjhCRtWlW-BH&ex=sovrn.com&gdpr=0&gdpr=0&gdpr_consent=
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
QMEKE5RJ80VRR5FN8HGE
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame B630
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=80&3pid=LJ4P1MPG-1E-GIGU&gdpr=0
43 B
853 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=80&3pid=LJ4P1MPG-1E-GIGU&gdpr=0
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
63.251.86.50 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2dca1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ce.lijit.com/merge?pid=80&3pid=LJ4P1MPG-1E-GIGU&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
e71ccbe96f42d70fa40603ada4c96b28
Expires
0
merge
ce.lijit.com/ Frame B630
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=&_bee_ppp=1
  • https://ce.lijit.com/merge?pid=85&3pid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=85&3pid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
63.251.86.50 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2dca1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
https://ce.lijit.com/merge?pid=85&3pid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
Date
Tue, 20 Jun 2023 19:44:03 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
merge
ce.lijit.com/ Frame B630
Redirect Chain
  • https://cms.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=43&gdpr=0&3pid=sxggjbUdIY6oTSnZ4Ek02rJJfIioSnrZskq7SIl1
43 B
877 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=43&gdpr=0&3pid=sxggjbUdIY6oTSnZ4Ek02rJJfIioSnrZskq7SIl1
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
63.251.86.50 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:03 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2dca1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
https://ce.lijit.com/merge?pid=43&gdpr=0&3pid=sxggjbUdIY6oTSnZ4Ek02rJJfIioSnrZskq7SIl1
date
Tue, 20 Jun 2023 19:44:03 GMT
content-length
0
sovrn
tr.blismedia.com/v1/api/sync/ Frame B630 		0
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.blismedia.com/v1/api/sync/sovrn?gdpr=0&gdpr_consent=
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.105.96.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
merge
ce.lijit.com/ Frame B630
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=87&3pid=967ba71f-887a-40cd-a2cb-fd1cbcd221c2
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=87&3pid=967ba71f-887a-40cd-a2cb-fd1cbcd221c2
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
63.251.86.50 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2dca1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
//ce.lijit.com/merge?pid=87&3pid=967ba71f-887a-40cd-a2cb-fd1cbcd221c2
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
no-cache, no-store, must-revalidate
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
PugMaster
image6.pubmatic.com/AdServer/ Frame 2390 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=539949&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
4c73bc8022226d1a73f2539913ed8a47adff1ccc3432b275e1eab91eff47df7e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Tue, 20 Jun 2023 19:44:01 GMT
content-length
1573
content-type
text/html; charset=UTF-8
collect
stats.g.doubleclick.net/j/ 		4 B
352 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-61435456-5&cid=690102992.1687290241&jid=2107558941&gjid=119770983&_gid=1597915438.1687290241&_u=aGBACEAiBAAAACgFK~&z=1982724632
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c0b::9a Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:44:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
a-04i4
i.liadm.com/s/c/ Frame FB79 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.137.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-137-149.compute-1.amazonaws.com
Software
/
Resource Hash
5779472c525d78941bcf719d14188b7104257c91253905e40277e5e0eae6ce06
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-cache, max-age=0
Connection
keep-alive
Content-Encoding
gzip
Content-Length
692
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:03 GMT
Request-Time
15
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
/
www.google.com/pagead/1p-user-list/11039244145/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/11039244145/?random=1687290241995&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&fmt=3&is_vtc=1&random=3419374339&rmt_tld=0&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/11039244145/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/11039244145/?random=1687290241995&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&fmt=3&is_vtc=1&random=3419374339&rmt_tld=1&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame BC82 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:03 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 03:39:20 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=28517
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 03:39:20 GMT
usync.js
eus.rubiconproject.com/ Frame 66CE 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:03 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 03:39:20 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=28517
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 03:39:20 GMT
ecm3
s.amazon-adsystem.com/ Frame A5A6
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&khaos=LJ4P1MPG-1E-GIGU
  • https://s.amazon-adsystem.com/ecm3?id=LJ4P1MPG-1E-GIGU&ex=d-rubiconproject.com&status=ok&gdpr=0
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=LJ4P1MPG-1E-GIGU&ex=d-rubiconproject.com&status=ok&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
SWN545NNKJ0AY5R5MZRH
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://s.amazon-adsystem.com/ecm3?id=LJ4P1MPG-1E-GIGU&ex=d-rubiconproject.com&status=ok&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
af308bb17a856a105b8c87aaae7d7f8c
Expires
0
publishertag.prebid.135.js
static.criteo.net/js/ld/ 		89 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.135.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Fri, 24 Feb 2023 07:57:32 GMT
server
nginx
etag
W/"63f86dec-16386"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:03 GMT
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-61435456-5&cid=690102992.1687290241&jid=2107558941&_u=aGBACEAiBAAAACgFK~&z=1389338695
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.ca/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-61435456-5&cid=690102992.1687290241&jid=2107558941&_u=aGBACEAiBAAAACgFK~&z=1389338695
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
362358.gif
idsync.rlcdn.com/ Frame FB79
Redirect Chain
  • https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=4160af57-86ed-4458-b49b-256a547d062b&us_privacy=1---
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=8df8ba75-afab-4bc2-a76d-d979183f805a%3A1687290243.9165657&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D8df8ba75-afab-4bc2-a76d-d979183...
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=968062838393799053&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D8df8ba75-afab-4bc2-a76...
  • https://idsync.rlcdn.com/501709.gif?partner_uid=8df8ba75-afab-4bc2-a76d-d979183f805a%3A1687290243.9165657&_=1687290243.919931
  • https://idsync.rlcdn.com/1000.gif?memo=CM3PHhJBCj0IARAFGjc4ZGY4YmE3NS1hZmFiLTRiYzItYTc2ZC1kOTc5MTgzZjgwNWE6MTY4NzI5MDI0My45MTY1NjU3EAAaDQiFg8ikBhIFCOgHEABCAEoA
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESEK5vvHT8FBTgMazEsUNFxbY&google_cver=1
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEK5vvHT8FBTgMazEsUNFxbY&google_cver=1
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:05 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEK5vvHT8FBTgMazEsUNFxbY&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
289
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
28292
i.liadm.com/s/ Frame FB79
Redirect Chain
  • https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D&us_privacy=1---
  • https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=8301830339311477822&us_privacy=1---
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@&us_privacy=1---
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-XFAtpQOBfkjgb_G6Me-kjLYL4fqlvUyXLrG7JQ&us_privacy=1---
43 B
633 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-XFAtpQOBfkjgb_G6Me-kjLYL4fqlvUyXLrG7JQ&us_privacy=1---
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
35.169.137.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-137-149.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:05 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
3
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-XFAtpQOBfkjgb_G6Me-kjLYL4fqlvUyXLrG7JQ&us_privacy=1---
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1082198
content-length
0
expires
Tue, 20 Jun 2023 00:00:00 GMT
52164
i.liadm.com/s/ Frame FB79
Redirect Chain
  • https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=4160af57-86ed-4458-b49b-256a547d062b&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1---
  • https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://x.bidswitch.net/sync?ssp=liveintent&user_id=4160af57-86ed-4458-b49b-256a547d062b
  • https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=liveintent&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=0443731d-ef67-4c6c-86ad-2109fa610bab&user_group=1&ssp=liveintent&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=b906d225-1d58-4500-8893-66f3b5de01e6
43 B
633 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
35.169.137.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-137-149.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:05 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
1
Content-Type
image/gif

Redirect headers

Location
//i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Date
Tue, 20 Jun 2023 19:44:05 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
35759
i6.liadm.com/s/ Frame FB79
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1---
  • https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
  • https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
2600:1f18:ed:550e:ae88:c386:1391:2528 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:04 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
1
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Date
Tue, 20 Jun 2023 19:44:04 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
1
img
sync.mathtag.com/sync/ Frame FB79 		43 B
442 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.mathtag.com/sync/img?mt_exid=36&4160af57-86ed-4458-b49b-256a547d062b&us_privacy=1---
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
74.121.140.211 Reston, United States, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MT3 1031 59fd23a master iad iad-pixel-x1 config_version:"3814" /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:04 GMT
Server
MT3 1031 59fd23a master iad iad-pixel-x1 config_version:"3814"
Content-Type
image/gif
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
43
Expires
Tue, 20 Jun 2023 19:44:03 GMT
35004
i.liadm.com/s/ Frame FB79
Redirect Chain
  • https://b1sync.zemanta.com/usersync/liveintent/?cb=//i.liadm.com/s/35004?bidder_id%3D98254%26bidder_uuid%3D__ZUID__&us_privacy=1---
  • https://stags.bluekai.com/site/23178?id=7dYANMJyrp6NSRwK_hfM&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DF4XWSLTMNFQWI3JOMNXW2L3TF4ZTKMBQGQ7WE2LEMRSXEX3JMQ6TSOBS...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=F4XWSLTMNFQWI3JOMNXW2L3TF4ZTKMBQGQ7WE2LEMRSXEX3JMQ6TSOBSGU2CMYTJMRSGK4S7OV2WSZB5G5SFSQKOJVFHS4TQGZHFGUTXJNPWQZSNEZSXQY3IMFXGOZJ5NRUXMZLJNZ2GK...
  • https://i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=7dYANMJyrp6NSRwK_hfM&us_privacy=1---
43 B
633 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=7dYANMJyrp6NSRwK_hfM&us_privacy=1---
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
35.169.137.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-137-149.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:04 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
2
Content-Type
image/gif

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Content-Type
text/html; charset=utf-8
Location
//i.liadm.com/s/35004?bidder_id=98254&bidder_uuid=7dYANMJyrp6NSRwK_hfM&us_privacy=1---
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
117
Expires
Thu, 01 Dec 1994 16:00:00 GMT
live_intent_sync
x.dlx.addthis.com/e/ Frame FB79
Redirect Chain
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=4160af57-86ed-4458-b49b-256a547d062b&us_privacy=1---
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=4160af57-86ed-4458-b49b-256a547d062b&us_privacy=1---&rd=Y
43 B
596 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=4160af57-86ed-4458-b49b-256a547d062b&us_privacy=1---&rd=Y
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
H2
Server
23.192.32.8 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-192-32-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=2628000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Tue, 20 Jun 2023 19:44:04 GMT
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
max-age=0, no-cache, no-store
strict-transport-security
max-age=2628000
content-length
43
content-type
image/gif

Redirect headers

location
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=4160af57-86ed-4458-b49b-256a547d062b&us_privacy=1---&rd=Y
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
max-age=0, no-cache, no-store
strict-transport-security
max-age=2628000
content-length
0
expires
Tue, 20 Jun 2023 19:44:04 GMT
container.html
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0F3F 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Wed, 19 Jun 2024 19:44:03 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2C97 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Wed, 19 Jun 2024 19:44:03 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
view
securepubads.g.doubleclick.net/pcs/ Frame 2FEF 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvhiWDUF6eI08sd2ZS831sscFSfbD0BtGjLOFBu2kbqN0kk-5d-A_1fffaWK5PNZd3t9MR-aHHZveLb0z3vZ6KXCW5-xYYEXQR0OVgVWUVdQuzr2Km0ZiG2DaKh9bcSXfGuAh8VW3vJcNlZm-uCMVvYB9lvkEnTd4sNtUq7sP_XpWo0urQHcBG4Ay8P3V6x2Jf-yCHipU9zNmYTeYddv-MS8aAld54zrHWWeSDtXfhScTHbPNvRWzBuOLWpwbNkl0BSuOohbNvrUMApPMfKTR2ay6SUxHUf0hVrpYfdiCbDFNqh_tBtnN1qYcFj5XfzybEFsLs_LBkCuwE5qyIXSLKZLTkzwsdDWWaywV7Rt2eY_JtQ_sfOX3M6mXbfEoKx5DpX39TL&sai=AMfl-YS7ki03lVsmYpE6zumzI4_V5gk9jFZ9pODOZvXU6cu2KPMhjkgD-orM6dyzKDwynVX38jSe30HPJpoUnpYOdGmwwxEWaiEoF6AZHTycfrwZYtLVkFtE0JkvRi3PJg&sig=Cg0ArKJSzAaeTQEol8tPEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
ttj
secure.adnxs.com/ Frame 2FEF 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/ttj?id=28334192
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.26 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
26b5e382ed7fcf2b1ab871c80a6d32b75522223b2001bd9d7a1718af5e6f3050
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:04 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
58e78318-4abf-4042-ab34-ef1f11189c77
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 2FEF 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:04 GMT
moatad.js
js.moatads.com/bangdfp107159576598/ Frame 2FEF 		0
442 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.44.133.31 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-44-133-31.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Unused62
8096267
Date
Tue, 20 Jun 2023 19:44:04 GMT
Last-Modified
Mon, 14 May 2018 18:19:42 GMT
Server
AmazonS3
x-amz-request-id
5QDD9FPYKA8WKE4H
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Content-Type
application/x-javascript
Cache-Control
max-age=55574
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
bDH2EEe2x2jwNFdEqZfUhAjXWMzjIl7/1Za37ePqTI/E8v5N2qnVAsEFfvcAEZi0xHwbRpCIs44=
pixel
protected-by.clarium.io/ Frame 2FEF 		68 B
244 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzMxMTE3MjA4NDM6MzAweDI1MA==&v=5&s=v31h3d5bqs7&id=eyJkZnAiOnsiYWQiOjUyMzM1MDI2MzYsImMiOjEzODQxMzUyMDM1MiwibCI6NjE1OTUyMjkwMiwibyI6MzExMTcyMDg0MywiQSI6Ii84MDEzL21lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC9jdWJlMV9ycmFpbF9hdGYiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTYtZ3B0In19&cb=6887081&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6TXhNVEUzTWpBNE5ETTZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjozMTExNzIwODQzLCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/png
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0
server
nginx/1.18.0 (Ubuntu)
expires
Sat, 26 Jul 1997 05:00:00 GMT
st
imprnjmp.taboola.com/ Frame A601 		7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imprnjmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8NMUCLAbgGQEK4mdf3xLAMwIUxM--vi0AAABgYID-AAl5fLONbTFyK3cTx1o0GtncCo9juRYuJw6XwznxeDyWISAhj2-2sS1GbuVu4liLRiObW-FxLNfC5cThcjgnHo_HMgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRA-mcjUJE3zXyIEjUUYAQAAAKjEyZQ9MkknqFhU-f__77cCcAUAIABRuyocNIvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjmIxcvoXNOXO4TA6PyTaZ2RwTi8NkWa4MM8dqeyRjf1xaaPRh-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3Ox2XhMa8XMsnGLFjbfWrhZLtcqy8w1srg2y5lhsxa9PqaLcWLcDRZbJBiwuBfJ0yKdKGcu32K5WplmvtXItZk5ZibHardZuZzL1WY4M0zEEs3JIp3ILvuOYTJy-RY258zhMjk8JttkZnNMLA6TZbkyzByrfcfkXGw2HtNaMbNs3KKFzbcWbpbLtcoyc40srs1yZtisRa-P6WKcGHeDxb4xG-4my8FktNg3ZsPdZDmYjBb7Dp3hu_qcjdLJUuzxaRfGcktncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrtgNVwkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrHHryAGw8lg_wBUiLVarW431mq1AA!&cmcv=&pix=undefined&cb=1687290244039&uv=134497419&tms=1687290244039&abt=nonrv_vA!ntvc_vB!tbt_unit!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=dc76c61d-97b1-44df-ac19-89baea9bccc2&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
d4aa3797d0820727bb2e73755dcddb64640c70aee9a08d9e0fbd3ce002c2e87d

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-type
text/html;charset=ISO-8859-1
date
Tue, 20 Jun 2023 19:44:04 GMT
server
nginx
vary
Accept-Encoding
via
1.1 varnish
x-cache
MISS
x-cache-hits
0
x-served-by
cache-yyz4535-YYZ
x-timer
S1687290244.064971,VS0,VE23
sync
us-match.taboola.com/ Frame 8555 		7 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://us-match.taboola.com/sync?dast=V8NMUCLAbgGQEK4mdf3xLAMwIUxM--vi0AAABgYID-AAl5fLONbTFyK3cTx1o0GtncCo9juRYuJw6XwznxeDyWISAhj2-2sS1GbuVu4liLRiObW-FxLNfC5cThcjgnHo_HMgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRA-mcjUJE3zXyIEjUUYAQAAAKjEyZQ9MkknqFhU-f__77cCcAUAIABRuyocNIvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjmIxcvoXNOXO4TA6PyTaZ2RwTi8NkWa4MM8dqeyRjf1xaaPRh-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3Ox2XhMa8XMsnGLFjbfWrhZLtcqy8w1srg2y5lhsxa9PqaLcWLcDRZbJBiwuBfJ0yKdKGcu32K5WplmvtXItZk5ZibHardZuZzL1WY4M0zEEs3JIp3ILvuOYTJy-RY258zhMjk8JttkZnNMLA6TZbkyzByrfcfkXGw2HtNaMbNs3KKFzbcWbpbLtcoyc40srs1yZtisRa-P6WKcGHeDxb4xG-4my8FktNg3ZsPdZDmYjBb7Dp3hu_qcjdLJUuzxaRfGcktncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrtgNVwkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrHHryAGw8lg_wBUiLVarW431mq1AA!&excid=22&docw=0&cijs=1&nlb=false
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
c3f5a365e519b032ccd4f69f5a5dade3077b83200efb5313936d71058d7df18d

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
text/html;charset=ISO-8859-1
date
Tue, 20 Jun 2023 19:44:04 GMT
machineid
3104
server
nginx
st
us-vid-events.taboola.com/ 		0
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-vid-events.taboola.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=66361655&crid=-1&dast=V8NMUCLAbgGQEK4mdf3xLAMwIUxM--vi0AAABgYID-AAl5fLONbTFyK3cTx1o0GtncCo9juRYuJw6XwznxeDyWISAhj2-2sS1GbuVu4liLRiObW-FxLNfC5cThcjgnHo_HMgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRA-mcjUJE3zXyIEjUUYAQAAAKjEyZQ9MkknqFhU-f__77cCcAUAIABRuyocNIvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjmIxcvoXNOXO4TA6PyTaZ2RwTi8NkWa4MM8dqeyRjf1xaaPRh-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3Ox2XhMa8XMsnGLFjbfWrhZLtcqy8w1srg2y5lhsxa9PqaLcWLcDRZbJBiwuBfJ0yKdKGcu32K5WplmvtXItZk5ZibHardZuZzL1WY4M0zEEs3JIp3ILvuOYTJy-RY258zhMjk8JttkZnNMLA6TZbkyzByrfcfkXGw2HtNaMbNs3KKFzbcWbpbLtcoyc40srs1yZtisRa-P6WKcGHeDxb4xG-4my8FktNg3ZsPdZDmYjBb7Dp3hu_qcjdLJUuzxaRfGcktncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrtgNVwkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrHHryAGw8lg_wBUiLVarW431mq1AA!&cmcv=&pix=31589837&cb=1687290244038&uv=134497419&tms=1687290244038&abt=nonrv_vA!ntvc_vB!tbt_unit!ufm_vE&ft=0&su=6&unm=FEED_MANAGER&debug=pn:!sqg:!torgn:1687290239086.8!ts:1687290244038&mntl=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
content-length
0
server
nginx
abtests
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:US:V&tvi2=10443&lti=deflated&ri=9fe7195e4f75d53f1fd1573ee99538f0&sd=v2_c02de7af9faedacd62ff1bbad29e0f15_cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701_1687290241_1687290241_CNawjgYQtdRXGOvB19KNMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687290241259&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22feed-distance-from-article-end%22%2C%22type%22%3A%22932.453125%22%2C%22eventTime%22%3A1687290244082%7D&tim=19%3A44%3A04.082&id=7305&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
b9pj45k4
sync-tm.everesttech.net/upi/pid/ Frame CC5A 		85 B
259 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
cache-control
no-cache
content-length
85
content-type
image/png
date
Tue, 20 Jun 2023 19:44:04 GMT
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma
no-cache
server
Jetty(9.4.35.v20201120)
via
1.1 varnish
x-cache
MISS
x-cache-hits
0
x-served-by
cache-yul12831-YUL
x-timer
S1687290244.116009,VS0,VE15
ecm3
s.amazon-adsystem.com/ Frame 9C7D 		43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:04 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
TWSW0W1923YG3CW6QXN6
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 2390
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=jofNXuhjSfSBAUnmPj1L2Q%3D%3D&gdpr=0&gdpr_consent=
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
content-encoding
gzip
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=165950
accept-ranges
bytes
content-length
5554
expires
Thu, 22 Jun 2023 17:49:54 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
receive
pixel.tapad.com/idsync/ex/ Frame 2390
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D76c19607-052e-43a5-b5b2-1d6cfe831e64%252C%252C
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1179662177681492769&pt=76c19607-052e-43a5-b5b2-1d6cfe831e64%2C%2C
95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1179662177681492769&pt=76c19607-052e-43a5-b5b2-1d6cfe831e64%2C%2C
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H3
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

Date
Tue, 20 Jun 2023 19:44:04 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
37085741-c4c5-49b3-8076-49eb29207951
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=1179662177681492769&pt=76c19607-052e-43a5-b5b2-1d6cfe831e64%2C%2C
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
xuid
eb2.3lift.com/ Frame 2390 		37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=7976&xuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
insync
thrtle.com/ Frame 2390
Redirect Chain
  • https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
  • https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&vxii_pid=12&vxii_pid1=10067&vxii_rcid=79a00523-d7f6-4653-bec7-3715ffc94b28
43 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&vxii_pid=12&vxii_pid1=10067&vxii_rcid=79a00523-d7f6-4653-bec7-3715ffc94b28
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
44.209.151.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-209-151-219.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI OUR BUS UNI COM NAV"
date
Tue, 20 Jun 2023 19:44:04 GMT
content-length
43
content-type
image/gif

Redirect headers

location
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&vxii_pid=12&vxii_pid1=10067&vxii_rcid=79a00523-d7f6-4653-bec7-3715ffc94b28
date
Tue, 20 Jun 2023 19:44:04 GMT
content-type
text/html; charset=utf-8
content-length
211
p3p
CP="NOI OUR BUS UNI COM NAV"
Pug
image2.pubmatic.com/AdServer/ Frame 2390
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OEU4N0NENUUtRTg2My00OUY0LTgxMDEtNDlFNjNFM0Q0QkQ5&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:49:02 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 2390
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECwE4banhqfisdfFzHL7LsM&google_cver=1
42 B
376 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECwE4banhqfisdfFzHL7LsM&google_cver=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:03 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESECwE4banhqfisdfFzHL7LsM&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 2390
Redirect Chain
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:FCA67877EA764E1F821EE4EC1A0C959E
42 B
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:FCA67877EA764E1F821EE4EC1A0C959E
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:52:12 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date
Tue, 20 Jun 2023 19:44:04 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:FCA67877EA764E1F821EE4EC1A0C959E
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Mon, 19 Jun 2023 19:44:04 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 2390
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8301830339311477822&gdpr=0&gdpr_consent=&us_privacy=
1 B
273 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8301830339311477822&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=8301830339311477822&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:03 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame 2390
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
42 B
541 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:52:09 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
355
ecm3
s.amazon-adsystem.com/ Frame A5A6
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=OiTEf5__RBaAQd8MtqczmQ&rk=usync-na&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=OiTEf5__RBaAQd8MtqczmQ&gdpr=0
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=OiTEf5__RBaAQd8MtqczmQ&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
B545149YWM5P363W2GD7
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=OiTEf5__RBaAQd8MtqczmQ&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
d67ad46d58ddbab9fb03c088eabaaff8
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
dcm
aax-eu.amazon-adsystem.com/s/ Frame A5A6 		43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.220.228.202 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
DV8A1M1AXZ7V84Y8HTV6
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame A5A6
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?id=LJ4P1MPG-1E-GIGU&ex=d-rubiconproject.com&status=ok&gdpr=0
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=LJ4P1MPG-1E-GIGU&ex=d-rubiconproject.com&status=ok&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
2Z5KBCK5YSRPKGSXWMW0
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://s.amazon-adsystem.com/ecm3?id=LJ4P1MPG-1E-GIGU&ex=d-rubiconproject.com&status=ok&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
d67ad46d58ddbab9fb03c088eabaaff8
Expires
0
tap.php
pixel.rubiconproject.com/ Frame A5A6
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESECqw6-icfhlaZAbUMRe6mSI&google_cver=1
42 B
723 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESECqw6-icfhlaZAbUMRe6mSI&google_cver=1
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
c1df09169f58a071f2a391dff1b3307b
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESECqw6-icfhlaZAbUMRe6mSI&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
337
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame A5A6
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZGQzNzllOTgwODM5NWExYThkOTNjMWQ2NmMwYzMzYTlhOTM4N2Y3OA&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZGQzNzllOTgwODM5NWExYThkOTNjMWQ2NmMwYzMzYTlhOTM4N2Y3OA&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
H3
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZGQzNzllOTgwODM5NWExYThkOTNjMWQ2NmMwYzMzYTlhOTM4N2Y3OA&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
d67ad46d58ddbab9fb03c088eabaaff8
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame A5A6
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/M2IIyuPC-IwEStNikcHoa8n5EUdSAgOZEtemQ7w0kco?csrc=&gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-__a7VMFE2oL_Nlnuz340pGQqZKwO_GK8yLWsvA--~A
42 B
723 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-__a7VMFE2oL_Nlnuz340pGQqZKwO_GK8yLWsvA--~A
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
e71ccbe96f42d70fa40603ada4c96b28
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Tue, 20 Jun 2023 19:44:04 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-__a7VMFE2oL_Nlnuz340pGQqZKwO_GK8yLWsvA--~A
content-length
0
pixel
cm.g.doubleclick.net/ Frame A5A6
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo0UDFNUEctMUUtR0lHVQ==&gdpr=0
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESEPRDEf3WUYhP8y9VYwLJdPs&google_cver=1
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UDFNUEctMUUtR0lHVQ==&google_push=&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UDFNUEctMUUtR0lHVQ==&google_push=&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
H3
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UDFNUEctMUUtR0lHVQ==&google_push=&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
314e432eb2d967cf733b82bdbbe35231
Expires
0
tap.php
pixel.rubiconproject.com/ Frame A5A6
Redirect Chain
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=&expires=30
42 B
703 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=&expires=30
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
ffef7c53154b04a892ce1f9531c32cb1
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=&expires=30
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
289
jfy5yp77cohy74fsw5uk.mp4
cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/ 		67 KB
67 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/jfy5yp77cohy74fsw5uk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5af7f54e4682da1be1484f658f9b15a84537085a4081cef229704a6d8e4ceb71

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
JhpPlUz7nZ57ILPZKofZM6pneMKKR0I4
date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 varnish
x-amz-request-id
BV32PXSKRRZVDTTS
age
103
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-68339/68340
x-amz-replication-status
COMPLETED
Content-Length
68340
x-amz-id-2
lZibJyPYpGrcXPFMgc3IsqbDj5sOc3pWGbNxM/NqLRY9Chh1T94tQP+JDjdkJYwToOYsKIQVC9I=
x-served-by
cache-yyz4535-YYZ
last-modified
Fri, 03 Feb 2023 08:45:58 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290244.180878,VS0,VE0
etag
"12d66db772be5305a2eda235f0b44b99"
content-type
video/mp4;codecs=avc1
abp
3
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
3003931
ae0ue1jbcjqu5byivgsm.mp4
cdn.taboola.com/libtrc/static/video/v1682562179/ 		463 KB
463 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1682562179/ae0ue1jbcjqu5byivgsm.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
03d9c6282533912a324c1d6f7c0c06583bed3f2c3a4a2331a6c36df3602faf52

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
1kIG7nplrGZPIHeqvx4bs.wW29YRS385
date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 varnish
x-amz-request-id
YWDZB70JFPTV4TSV
age
82
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-474042/474043
x-amz-replication-status
COMPLETED
Content-Length
474043
x-amz-id-2
sPWoV9t/5jiGI9xHumsxNDWayxqWz79zv3wbXlBPbLyOwWyT+D6/oviy0FeJCjgYC3UQkKgZtx4=
x-served-by
cache-yyz4535-YYZ
last-modified
Thu, 27 Apr 2023 02:23:05 GMT
server
AmazonS3
x-timer
S1687290244.180851,VS0,VE1
etag
"f3a359ea66d151486ab4c08935a18108"
content-type
video/mp4;codecs=avc1
abp
45
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
apioyas5ui0dh2xpewrm.mp4
cdn.taboola.com/libtrc/static/video//w_600,c_scale/v1666981579/ 		466 KB
466 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video//w_600,c_scale/v1666981579/apioyas5ui0dh2xpewrm.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1cfd94e29569cdb86e0af17ba81d1ee4afb420ec526807697af20dc923f1a52e

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
sOf42BKddYCcuAA6EkKkJIfpYyEuQ2.G
date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 varnish
x-amz-request-id
SG97S4QFX9DC5EVM
age
79
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-476901/476902
x-amz-replication-status
COMPLETED
Content-Length
476902
x-amz-id-2
C54XUUBP1qcdKBkapkHwqwVrCUxwWDLk+La+McMnydUyOLv5hiDSMQU/XZAc6QVqgV5R6tMJ6gg=
x-served-by
cache-yyz4535-YYZ
last-modified
Fri, 28 Oct 2022 18:26:28 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290244.180842,VS0,VE1
etag
"edfd9f1ac54fbee9c56f02110ac8b8f5"
content-type
video/mp4;codecs=avc1
abp
22
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
cktcnyyudrurusyfjouk.mp4
cdn.taboola.com/libtrc/static/video/v1685950230/ 		1 MB
0 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1685950230/cktcnyyudrurusyfjouk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
d6ueGktFcB2EwN7zocuabc2gAAuw1YPA
date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 varnish
x-amz-request-id
C4NX8W6QGYMSVYSQ
age
12
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-1248084/1248085
x-amz-replication-status
COMPLETED
Content-Length
1248085
x-amz-id-2
jrobY0g2BRiVVJDVVxwdHK6sjsQcWsM5DsbJyKNkEp10Wwcs5NdGBRdBZYPiatSyYr6Ew07DItg=
x-served-by
cache-yyz4535-YYZ
last-modified
Mon, 05 Jun 2023 07:30:39 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290244.181211,VS0,VE1
etag
"e73e901218df8f12f0d31914663c3397"
content-type
video/mp4;codecs=avc1
abp
93
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
bulk
trc.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
470 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/medianewsgroup-mercurynews/log/3/bulk?tvi2=10443&route=US%3AUS%3AV&lti=deflated&bulkSize=5
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

x-vcl-time-ms
27
date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 varnish
x-fastly-to-nlb-rtt
22565
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v2
x-served-by
cache-yyz4535-YYZ
pragma
no-cache
server
nginx
x-timer
S1687290244.202126,VS0,VE27
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
log
protected-by.clarium.io/ Frame 0F3F 		0
0
log
protected-by.clarium.io/ Frame 0F3F 		0
222 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 0F3F 		0
0
log
protected-by.clarium.io/ Frame 2C97 		0
0
log
protected-by.clarium.io/ Frame 2C97 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 2C97 		0
0
usersync
usersync.gumgum.com/ Frame BC82
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&gdpr_consent=undefined&gdpr=0&khaos=LJ4P1MPG-1E-GIGU
  • https://usersync.gumgum.com/usersync?b=mag&i=LJ4P1MPG-1E-GIGU&gdpr=0&gdpr_consent=undefined
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=mag&i=LJ4P1MPG-1E-GIGU&gdpr=0&gdpr_consent=undefined
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usersync.gumgum.com/usersync?b=mag&i=LJ4P1MPG-1E-GIGU&gdpr=0&gdpr_consent=undefined
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
0190a17a18f2299b1b85aeb1793e601c
Expires
0
cs
cs.yellowblue.io/ Frame 66CE
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr_consent=undefined&gdpr=0&khaos=LJ4P1MPG-1E-GIGU
  • https://cs.yellowblue.io/cs?aid=11590&id=LJ4P1MPG-1E-GIGU&gdpr=0&gdpr_consent=undefined
0
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11590&id=LJ4P1MPG-1E-GIGU&gdpr=0&gdpr_consent=undefined
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://eus.rubiconproject.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cs.yellowblue.io/cs?aid=11590&id=LJ4P1MPG-1E-GIGU&gdpr=0&gdpr_consent=undefined
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
83041abbe8494cb29eff3083edd6dff6
Expires
0
publishertag.prebid.js
static.criteo.net/js/ld/ 		94 KB
30 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
bc82310d2b82f3aa74a269e8f679359bda827c649adb41486fd1af268a026ac1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 31 May 2023 13:09:50 GMT
server
nginx
etag
W/"6477471e-176eb"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:04 GMT
sync
gum.criteo.com/ Frame 2FEF 		78 B
318 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
105b7dfb695fef25edebb431efe72fa3d34ff28af8dfa3ba360528eed4f8688d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:03 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
893186
expires
60
ttj
secure.adnxs.com/ Frame 2FEF 		5 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/ttj?ttjb=1&bdc=1687290244&bdh=yZI7NFuCmvPqMXz3PgUuAzr48is.&&bdref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F,https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&&id=28334192
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.26 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4c3266121854510a342e6633c770a9664f08975777607c27612242e4cf5fd059
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:04 GMT
Content-Encoding
gzip
X-Creative-ID
398539822
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
43decb08-3f1e-4956-aba3-97289e09a81d
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
common.js
maps.googleapis.com/maps-api-v3/api/js/53/7a/ 		273 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/53/7a/common.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c38bc51d1b1c8db7f2037ae18da46d0fb6733d3e7bee635e160eb73f870d5a6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 14:45:41 GMT
content-encoding
br
x-content-type-options
nosniff
age
17903
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
61560
x-xss-protection
0
last-modified
Thu, 15 Jun 2023 00:18:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 14:45:41 GMT
util.js
maps.googleapis.com/maps-api-v3/api/js/53/7a/ 		164 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/53/7a/util.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5ad96953ed9f09eb237595f0947c8a02ebc9b14131cd128fecdfc16bf91297ba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 16:37:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
11198
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
52674
x-xss-protection
0
last-modified
Thu, 15 Jun 2023 00:18:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 16:37:26 GMT
integrator.js
adservice.google.com/adsid/ 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3515810653216537&correlator=1870364646369453&eid=31074948%2C31075339&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=6&adks=1140109686&didk=1622125026&sfv=1-0-40&ris=1&rcs=1&prev_scp=pos%3DSponsorship_1%26confiant_refresh%3Dtrue%26htl_refresh%3D1&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D46f21ba418c8944f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_Mb9T8C51CxOA0VbrwUKyKOrzu4s6g&gpic=UID%3D00000c52bcfe7c0f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_MYm7YW-LLGO3cnvTDwuDeHDm2mpiw&abxe=1&dt=1687290244692&lmt=1687290244&dlt=1687290239156&idt=1771&adxs=3085&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=300x50&msz=300x50&fws=3076&ohw=1254&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvh-e_sq2mCgV31wYQf2-D5xS28_CvUtFNipQvNcJvoH3hBpvXXcoV44j9Ckd7lPYagvCN1qgPpEyYxSDFPp5LRnECZJx7q7&ga_vid=690102992.1687290241&ga_sid=1687290243&ga_hid=1249931897&ga_fc=true&ga_cid=1597915438.1687290241&a3p=EhkKCnVpZGFwaS5jb20Y-b_X0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRieyNfSjTFIAFICCGoSGQoKcHViY2lkLm9yZxjZw9fSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y-b_X0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
42167231fcba70dca531765a4ded0dadc84655682060d75289c9c753acaa13ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13030
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
t.js
sopalk.com/ Frame 2FEF 		65 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/t.js?i=qzf6dxi5wc8fiu0hxffwm&cb=9545231687290244745
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-47.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d2cf823ebd1e2d7b0649b99673b599eda7de0e6f83e2ef0d09531576709b0ec8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
R1D2s3Kk5zdoPZnfOnKtnRrfDKgJdfzA
content-encoding
gzip
via
1.1 2ba01a121d51ee735a8dde7a86ed73b6.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 16:43:22 GMT
last-modified
Mon, 29 May 2023 16:40:15 GMT
server
AmazonS3
x-amz-cf-pop
EWR53-P1
age
10844
x-amz-server-side-encryption
AES256
etag
W/"79d67edd63b460a375a4fe1a6b64d45f"
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
yNaazJH9R3yyJD2MKEGHlktOfte6ReZPJz3dSGg2qGwAfRyu6giI7w==
async_usersync.html
acdn.adnxs.com/dmp/ Frame FD87 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1922&pub_id=2234281
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:04 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:06 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
trk.js
cdn.adnxs.com/v/s/236/ Frame 2FEF 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:44:04 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
456181
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12830-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687290245.803839,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 66340
it
nym1-ib.adnxs.com/ Frame 2FEF 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&e=wqT_3QKzCqAzBQAAAwDWAAUBCISDyKQGELm8kOyUnIHIORihlq39gZDArxAqNgkAAAECCOg_EQEHNAAA6D8ZAAAAgOtR6D8hERIAKREJADERG7Aw8LDBDTiCD0CCD0gCUK74hL4BWIaMowFgAGi488YBePe8BYABAYoBA1VTRJIFBvReAZgBrAKgAfoBqAEBsAEAuAECwAEEyAEC0AEA2AEA4AEA8AEAigIqdWYoJ2EnLCAyMTk3MjU4LCAwKTt1ZigncicsIDM5ODUzOTgyMiwgMCk7kgLxAyFaRTNOeXdpbm9JSWFFSzc0aEw0QkdBQWdob3lqQVRBQU9BQkFBMGlDRDFEd3NNRU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUU93QVFDNUFiN1FUTVVBQU9nX3dRRy0wRXpGQUFEb1A4a0JnRDM5bEFjSEFFRFpBUUFBQUFBQUFQQV80QUVBOVFFQUFBQUFtQUlBb0FJQXRRSUFBQUFBdlFJQUFBQUF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJ1Z01KVGxsTk1qbzBPVGs1NEFQcFE0Z0VBSkFFQUpnRUFjRUVBQUFBQUFBQUFBREpCQQ0LJEFBQTJBUUE4UVEBCwkBHElnRmh5ZXBCERMUUEFfc1FVCRwBAQhNRUYBBwkBBERKFSgMQUFBMC4oAAROay4oALBnQmZqSkJQQUY1b0dyQ2ZnRmlvNkdBWUlHQTFWVFJJZ0dBSkFHQVpnR0FLRUcBTAEBLDZELW9CZ0d5QmlRSgEQDQEAUg0IAQEAWgEFDQEAaA0IUEFBQUM0QmlnLpoCmQEhb3hDTC1naTb1ASxJYU1vd0VnQXlnQU0R6VRPZ19PZ2xPV1UweU9qUTVPVGxBNlVOFXkIOEQ5HXkAQh15AEIdeQhCcEEVAQRCeBULGEFCNEFJa0IZEPQ0AUEu2ALWCeACh5wK6gKCAWh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy-AAwCIAwGQAwCYAxmgAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE3OKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE5MjIjTllNMjo0OTk52gQCCAHgBADwBK74hL4BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAIlYaNgFAeAFAfAFAfoFBAgAEACQBgCYBgC4BgDBBgkhKPA_0AbpBtoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB_e8BdIHDQkRKAEmCNoHBgFdcBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=acf538d48389741634c2be80a164f79dae7b44de
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
AN-X-Request-Uuid
5bcf8355-5103-4081-b3a5-91d571ee0396
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjE1OTUyMjkwMiIsImVidXkiOiIzMTExNzIwODQzIiwiZWFkdiI6IjUyMzM1MDI2MzYiLCJlY2lkIjoiMTM4NDEzNTIwMzUyIiwiZWVudiI6ImoiLCJlcGlkIjoiMjIxMzg1NDYyNDUiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=1f570788-6a35-4698-a435-d9992ba0bf47&pid=45fbb049-cd4d-4548-b342-1bd2d9960567&dtm=1687290244807&qnm=_matherq&visible=1&tabid=d1035f59-8a38-44c6-83f8-8befa73f770a&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x8818&tofa=1687290242&vid=1&lvidt=1687290242&duid=ba10b823-5015-4d9c-bc8f-648a9ff50d11&fp=967226427&cid=ma23578&mrk=239876506
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:04 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
truncated
/ Frame 2FEF 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a1e1f394d80cb863930fcf77bfa7cb31c24012649626faa11d36353f5267ddf6

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
rtb-h
sync.taboola.com/sg/supershiprtb-display-network/1/ Frame 8809
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=taboola
  • https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBg8Co8YQAAMZ2WjUAAAAA
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBg8Co8YQAAMZ2WjUAAAAA
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27675

Redirect headers

Date
Tue, 20 Jun 2023 19:44:04 GMT
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=taboola","cluster_id":0,"gdpr":false,"ipv4":"149.56.153.178","key":"ZJIBg8Co8YQAAMZ2WjUAAAAA","privacy_sensitive":false,"uid":"ZJIBg8Co8YQAAMZ2WjUAAAAA","upstream_id":"a-ad40367"}
X-SO-Key
ZJIBg8Co8YQAAMZ2WjUAAAAA
X-SO-Upstream-ID
a-ad40367
P3P
CP="See also http://www.scaleout.jp/privacy/"
X-SO-HostName
a-ad40367.dc2p.scaleout.jp
X-SO-UID
ZJIBg8Co8YQAAMZ2WjUAAAAA
Connection
keep-alive
Content-Length
0
X-SO-IP
149.56.153.178
X-SO-Cluster-ID
0
Server
nginx
Location
https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBg8Co8YQAAMZ2WjUAAAAA
Cache-Control
private
X-SO-Ads-Time
2
X-SO-LB-Hostname
m-tgng32.dc4p.scaleout.jp
/
sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__&nut&uu=7e7e6a26c4614795a3...
  • https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=7e7e6a26c4614795a39d50bb401edffb
0
221 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=7e7e6a26c4614795a39d50bb401edffb
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
31058

Redirect headers

location
https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=7e7e6a26c4614795a39d50bb401edffb
date
Tue, 20 Jun 2023 19:44:05 GMT
content-length
0
sync
ssbsync.smartadserver.com/api/ Frame 8809 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.105.14.100 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.100.rdns.racklot.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
/
sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698
  • https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4P1MPG-1E-GIGU
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4P1MPG-1E-GIGU
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
26499

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4P1MPG-1E-GIGU
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
8bab65602db075726861004da5629947
Expires
0
/
sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/taboola/cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701?gdpr=0&gdpr_consent=&us_privacy=1---
  • https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ocRLxGNE2oReUjEympH9QO9IbxKnVQjHIbublg--~A
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ocRLxGNE2oReUjEympH9QO9IbxKnVQjHIbublg--~A
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
26499

Redirect headers

date
Tue, 20 Jun 2023 19:44:04 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ocRLxGNE2oReUjEympH9QO9IbxKnVQjHIbublg--~A
content-length
0
/
sync.taboola.com/sg/baidurtb-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://trace.mediago.io/ju/cs/taboola
  • https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=00330d6dd843346dbfa2c28e0164fa30
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=00330d6dd843346dbfa2c28e0164fa30
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27675

Redirect headers

location
https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=00330d6dd843346dbfa2c28e0164fa30
date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8
content-type
text/plain; charset=utf-8
/
trc.taboola.com/sg/google-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEBlFnRCSMfP6ZCFtK8QMK5Q&google_cver=1
0
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEBlFnRCSMfP6ZCFtK8QMK5Q&google_cver=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
25
date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 varnish
x-served-by
cache-yyz4535-YYZ
server
nginx
x-timer
S1687290245.957293,VS0,VE25
x-fastly-to-nlb-rtt
21418
x-cache
MISS
accept-ranges
bytes
content-length
0
x-service-version
v2
x-cache-hits
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEBlFnRCSMfP6ZCFtK8QMK5Q&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
304
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 8809 		42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701:$UID
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:03 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
pixel
cm.g.doubleclick.net/ Frame 8809
Redirect Chain
  • https://sync.taboola.com/sg/google-network/1/rtb/?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701
date
Tue, 20 Jun 2023 19:44:04 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27140
/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=59f17c06-c5d2-4b1e-89aa-3d64ff091022
0
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
25
date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 varnish
x-served-by
cache-yyz4535-YYZ
server
nginx
x-timer
S1687290245.953343,VS0,VE25
x-fastly-to-nlb-rtt
20904
x-cache
MISS
accept-ranges
bytes
content-length
0
x-service-version
v2
x-cache-hits
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=59f17c06-c5d2-4b1e-89aa-3d64ff091022
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
239
merge
ce.lijit.com/ Frame 8809 		43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=42&3pid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&us_privacy=1---&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
63.251.86.50 , United States, ASN10913 (INTERNAP-BLK, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:04 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap2dca1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame 8809 		49 B
897 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=553204&ev=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
content-type
image/gif;charset=iso-8859-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
/
rtb-csync.smartadserver.com/redir/ Frame 8809 		43 B
438 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=107&partneruserid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40
  • https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=e4d4e64e-e370-4886-a057-02f441b10d0f
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=e4d4e64e-e370-4886-a057-02f441b10d0f
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27675

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=e4d4e64e-e370-4886-a057-02f441b10d0f
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1094069
content-length
0
expires
Tue, 20 Jun 2023 00:00:00 GMT
/
sync.taboola.com/sg/id5-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://id5-sync.com/s/464/9.gif?puid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D...
  • https://id5-sync.com/c/464/464/7/1.gif?puid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&gdpr=0&gdpr_consent=&us_privacy=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/264.gif?puid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&ttl=%%TTL%%
  • https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F434%2F5%2F3.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
  • https://id5-sync.com/c/464/434/5/3.gif?puid=7f6700ef-9efd-41da-8a71-72c3ea800d51&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F4%2F4.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/464/441/4/4.gif?puid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/464/2/3/5.gif?puid=$UID&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/464/2/3/5.gif?puid=1179662177681492769&gdpr=0&gdpr_consent=
  • https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F2%2F6.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F2%2F6.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/464/112/2/6.gif?puid=7D6AE0D8CA7C0A32&gdpr=0&gdpr_consent=
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F429%2F1%2F7.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
  • https://id5-sync.com/c/464/429/1/7.gif?puid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-404b5IlA-MM2sBNTwoXVCFNDOZsXFrSWDrEHq111qQ&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F3%2F0%2F8.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26g...
  • https://id5-sync.com/c/464/3/0/8.gif?puid=c0d66492-0183-4f00-930f-e67415c7188d&gdpr=0&gdpr_consent=
  • https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-404b5IlA-MM2sBNTwoXVCFNDOZsXFrSWDrEHq111qQ
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-404b5IlA-MM2sBNTwoXVCFNDOZsXFrSWDrEHq111qQ
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
29974

Redirect headers

location
https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-404b5IlA-MM2sBNTwoXVCFNDOZsXFrSWDrEHq111qQ
date
Tue, 20 Jun 2023 19:44:08 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding
chunked
p3p
CP="CAO PSA OUR"
rtb-h
sync-t1.taboola.com/sg/bidswitch-network/1/ Frame 8809
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://p.rfihub.com/cm?in=1&pub=20513&ssp=taboola&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=119&user_id=968062838393799511&expires=30&ssp=taboola
  • https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
32351

Redirect headers

Location
//sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd=&us_privacy=
Date
Tue, 20 Jun 2023 19:44:05 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
rtb-h
match.taboola.com/sg/mediaforcebidder-network/1/ Frame 8809
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=taboola
  • https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=967ba71f-887a-40cd-a2cb-fd1cbcd221c2
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=967ba71f-887a-40cd-a2cb-fd1cbcd221c2&tbid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&query=taboola_hm%3D967ba71f-887a-...
0
86 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=967ba71f-887a-40cd-a2cb-fd1cbcd221c2&tbid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&query=taboola_hm%3D967ba71f-887a-40cd-a2cb-fd1cbcd221c2&isDirect=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 20 Jun 2023 19:44:05 GMT
via
1.1 varnish
server
nginx
x-timer
S1687290245.147991,VS0,VE23
x-cache
MISS
accept-ranges
bytes
content-length
0
x-served-by
cache-yyz4535-YYZ

Redirect headers

location
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=967ba71f-887a-40cd-a2cb-fd1cbcd221c2&tbid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&query=taboola_hm%3D967ba71f-887a-40cd-a2cb-fd1cbcd221c2&isDirect=0
date
Tue, 20 Jun 2023 19:44:04 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
26499
sd
u.openx.net/w/1.0/ Frame 8809 		43 B
163 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://u.openx.net/w/1.0/sd?id=543998486&val=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT
xuid
eb2.3lift.com/ Frame 8809 		37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=7772&xuid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&dongle=tbla&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
rtb-h
sync.taboola.com/sg/stackadaptrtb-network/1/ Frame 8809
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=140
  • https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=cuj0HMYUXER6RDS6pY-AEJU4mbI
0
221 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=cuj0HMYUXER6RDS6pY-AEJU4mbI
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27032

Redirect headers

Location
https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=cuj0HMYUXER6RDS6pY-AEJU4mbI
Date
Tue, 20 Jun 2023 19:44:04 GMT
Connection
keep-alive
Content-Length
119
Content-Type
text/html; charset=utf-8
sync
t.adx.opera.com/ Frame 8809 		35 B
467 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.adx.opera.com/sync?vendor=60151&uid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
82.145.213.8 , Norway, ASN39832 (NO-OPERA, NO),
Reverse DNS
n-sysadmin-jumpbox-03.feednews.opera.technology
Software
Tengine /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:05 GMT
server
Tengine
access-control-allow-methods
POST, GET
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&ph=295bf259-a378-4089-aae8-a2a995ba8627&id=37f45540-fa88-4005-bf73-8a7ac39467e3&r=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fopenxrtb-network%2F1%2Fr...
  • https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=bbb3b40c-3cb7-4468-ad0e-4741210b8afc
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=bbb3b40c-3cb7-4468-ad0e-4741210b8afc
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27032

Redirect headers

date
Tue, 20 Jun 2023 19:44:04 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=bbb3b40c-3cb7-4468-ad0e-4741210b8afc
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
/
sync.taboola.com/sg/centrortb-network/1/rtb-h/ Frame 8809
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=121&0&&us_privacy=1---&redir=
  • https://sync.taboola.com/sg/centrortb-network/1/rtb-h/?taboola_hm=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/centrortb-network/1/rtb-h/?taboola_hm=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27675

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:04 GMT
server
A
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://sync.taboola.com/sg/centrortb-network/1/rtb-h/?taboola_hm=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
cds-pips.js
cdn.taboola.com/scripts/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/scripts/cds-pips.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e7d49f24d56db02c7baca8ae3a17555c2e527571450e8c24c77b453407e267a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
z5FoayaLm_Bvew3pbkytkoHczFCvkPwT
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:04 GMT
x-amz-request-id
345CDBWW70P2J4KQ
age
2855
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
1340
x-amz-id-2
RXZ9eF1pCd0CDN+zmZsBdUvWy9zP/THQYOkdE0w5cIOOD+5zdquMw/vB8dFwYkBREq+fn3ZvR+o=
x-served-by
cache-yyz4535-YYZ
last-modified
Wed, 12 Oct 2022 13:57:57 GMT
server
AmazonS3
x-timer
S1687290245.868184,VS0,VE0
etag
"383fa66d2a0a09f4a6e64a9593ad43bb"
vary
Accept-Encoding
content-type
application/javascript
abp
14
access-control-allow-origin
*
cache-control
private, max-age=3600
accept-ranges
bytes
x-cache-hits
4093
fraud-detect.js
cdn.taboola.com/scripts/ 		121 B
425 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/scripts/fraud-detect.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
392c32f20b9f867852a946a6ed1c5e21476df9619083548b6585d80a3b5f9bd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
vOXBAr_FxKHpU348.XTQhP6DWnVyKple
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:04 GMT
x-amz-request-id
S9J5BFAA7WPTMDGJ
age
520
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
125
x-amz-id-2
wWtPRy+nUtfHDp77gPzlWCF3v6EWhngazARKv0aGBw+bq/wfsPbkn4AZ0roXloZfIZagWP16wbs=
x-served-by
cache-yyz4535-YYZ
last-modified
Thu, 15 Dec 2022 16:50:08 GMT
server
AmazonS3
x-timer
S1687290245.875868,VS0,VE0
etag
"f7a185d92ac2162dc0bc36c5d7ef7dfe"
vary
Accept-Encoding
content-type
application/javascript
abp
27
access-control-allow-origin
*
cache-control
private,max-age=14400
accept-ranges
bytes
x-cache-hits
567
eidf.es5.js
cdn.taboola.com/scripts/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/scripts/eidf.es5.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
3979WkHCSLO5cQCJAWoE4w7tW4Dv40AW
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:04 GMT
x-amz-request-id
MDF1ZN70T49XVY6T
age
21155
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
6467
x-amz-id-2
31MCdrWlJaO7VPTkeijfDCddcoc5wZ3qnEGbq/lzCgvbwa2jcTEBhuQ1KkKYGDl9+MpeTIwTpvw=
x-served-by
cache-yyz4535-YYZ
last-modified
Sun, 02 Apr 2023 13:49:08 GMT
server
AmazonS3
x-timer
S1687290245.877709,VS0,VE0
etag
"2fdf3e79d5e851201a0d52a886453d8b"
vary
Accept-Encoding
content-type
application/javascript
abp
20
access-control-allow-origin
*
cache-control
private,max-age=14400
accept-ranges
bytes
x-cache-hits
35345
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3515810653216537&correlator=1445840214213104&eid=31074948%2C31075339&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Ctop_leaderboard&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=7&adks=142133714&didk=303353385&sfv=1-0-40&ris=2&rcs=1&prev_scp=pos%3Dtop_leaderboard%26confiant_refresh%3Dtrue%26htl_refresh%3D1&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D46f21ba418c8944f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_Mb9T8C51CxOA0VbrwUKyKOrzu4s6g&gpic=UID%3D00000c52bcfe7c0f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_MYm7YW-LLGO3cnvTDwuDeHDm2mpiw&abxe=1&dt=1687290244911&lmt=1687290244&dlt=1687290239156&idt=1771&adxs=1515&adys=243&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=970x250&msz=970x250&fws=1028&ohw=1280&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvh-e_sq2mCgV31wYQf2-D5xS28_CvUtFNipQvNcJvoH3hBpvXXcoV44j9Ckd7lPYagvCN1qgPpEyYxSDFPp5LRnECZJx7q7&ga_vid=690102992.1687290241&ga_sid=1687290243&ga_hid=1249931897&ga_fc=true&ga_cid=1597915438.1687290241&a3p=EhkKCnVpZGFwaS5jb20Y-b_X0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRieyNfSjTFIAFICCGoSGQoKcHViY2lkLm9yZxjZw9fSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y-b_X0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2d807b19c6bf86acf54706af03abe962dbd480058139107998c5ccc7574b0ea2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12976
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjE1OTUyMjkwMiIsImVidXkiOiIzMTExNzIwODQzIiwiZWFkdiI6IjUyMzM1MDI2MzYiLCJlY2lkIjoiMTM4NDEzNTIwMzUyIiwiZWVudiI6ImoiLCJlcGlkIjoiMjIxMzg1NDYyNDUiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=0810e688-b457-4966-b960-f89a9d44eeed&pid=45fbb049-cd4d-4548-b342-1bd2d9960567&dtm=1687290244813&qnm=_matherq&visible=1&tabid=d1035f59-8a38-44c6-83f8-8befa73f770a&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x8818&tofa=1687290242&vid=1&lvidt=1687290242&duid=ba10b823-5015-4d9c-bc8f-648a9ff50d11&fp=967226427&cid=ma23578&mrk=239876506
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:04 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
qzf6dxi5wc8fiu0hxffwm.json
sopalk.com/c/ Frame 2FEF 		1 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/c/qzf6dxi5wc8fiu0hxffwm.json?cb=1687290244954
Requested by
Host: sopalk.com
URL: https://sopalk.com/t.js?i=qzf6dxi5wc8fiu0hxffwm&cb=9545231687290244745
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-47.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e561b7eb91282aba0090eb6b74465305f2dbfd9c5ff885d344ec2721fe6f978f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
3Iuzq4_MkubxXamFySNQopDhCIqJt6_4
date
Tue, 20 Jun 2023 11:00:58 GMT
via
1.1 acbc1e922360be31edf0371abdc7a3a4.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-P1
age
31406
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
1298
last-modified
Tue, 20 Dec 2022 11:07:27 GMT
server
AmazonS3
etag
"e55d9f069a60da5619fc41a69ff8d5d7"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
accept-ranges
bytes
x-amz-cf-id
kq392dX3rk2GmvRkfEMdhi03brLp2UKIxeIhVgh6QIhgnPgFRAyBwg==
/
pips.taboola.com/ 		64 B
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pips.taboola.com/
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
05112ac6bec76b85c530e82120bd2b9b567f7d82e218a13e397076b96210c74c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
cache-yul12834-YUL
date
Tue, 20 Jun 2023 19:44:05 GMT
via
1.1 varnish
server
Varnish
access-control-allow-methods
GET
x-cache
HIT
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-store
accept-ranges
bytes
content-length
64
retry-after
0
x-cache-hits
0
vevent
nym1-ib.adnxs.com/ Frame 2FEF 		0
959 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&e=wqT_3QKzCqAzBQAAAwDWAAUBCISDyKQGELm8kOyUnIHIORihlq39gZDArxAqNgkAAAECCOg_EQEHNAAA6D8ZAAAAgOtR6D8hERIAKREJADERG7Aw8LDBDTiCD0CCD0gCUK74hL4BWIaMowFgAGi488YBePe8BYABAYoBA1VTRJIFBvReAZgBrAKgAfoBqAEBsAEAuAECwAEEyAEC0AEA2AEA4AEA8AEAigIqdWYoJ2EnLCAyMTk3MjU4LCAwKTt1ZigncicsIDM5ODUzOTgyMiwgMCk7kgLxAyFaRTNOeXdpbm9JSWFFSzc0aEw0QkdBQWdob3lqQVRBQU9BQkFBMGlDRDFEd3NNRU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUU93QVFDNUFiN1FUTVVBQU9nX3dRRy0wRXpGQUFEb1A4a0JnRDM5bEFjSEFFRFpBUUFBQUFBQUFQQV80QUVBOVFFQUFBQUFtQUlBb0FJQXRRSUFBQUFBdlFJQUFBQUF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJ1Z01KVGxsTk1qbzBPVGs1NEFQcFE0Z0VBSkFFQUpnRUFjRUVBQUFBQUFBQUFBREpCQQ0LJEFBQTJBUUE4UVEBCwkBHElnRmh5ZXBCERMUUEFfc1FVCRwBAQhNRUYBBwkBBERKFSgMQUFBMC4oAAROay4oALBnQmZqSkJQQUY1b0dyQ2ZnRmlvNkdBWUlHQTFWVFJJZ0dBSkFHQVpnR0FLRUcBTAEBLDZELW9CZ0d5QmlRSgEQDQEAUg0IAQEAWgEFDQEAaA0IUEFBQUM0QmlnLpoCmQEhb3hDTC1naTb1ASxJYU1vd0VnQXlnQU0R6VRPZ19PZ2xPV1UweU9qUTVPVGxBNlVOFXkIOEQ5HXkAQh15AEIdeQhCcEEVAQRCeBULGEFCNEFJa0IZEPQ0AUEu2ALWCeACh5wK6gKCAWh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy-AAwCIAwGQAwCYAxmgAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE3OKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE5MjIjTllNMjo0OTk52gQCCAHgBADwBK74hL4BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAIlYaNgFAeAFAfAFAfoFBAgAEACQBgCYBgC4BgDBBgkhKPA_0AbpBtoGFgoQCREZAXQQABgA4AYB8gYCCACABwGIBwCgBwHIB_e8BdIHDQkRKAEmCNoHBgFdcBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=acf538d48389741634c2be80a164f79dae7b44de&type=nv&nvt=5&jm=1003&px=2337&py=874&bw=300&bh=250&sid=3511539801863858522&vd=ct~0|rr~0&sv=236&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=28334192&sw=1600&sh=1200&pw=4000&ph=8818&ww=1600&wh=1200&ft=2
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:05 GMT
AN-X-Request-Uuid
d5eab3fc-eb87-4108-ad7f-22db5065e9b6
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 2FEF 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstnJHcWOvh2MATRLf2IXbKgmNCXuTF8XPshWt2sB4dsQ7NPOEMPvYogWiUtW5oLbNfHcvQti67yqW-n6r7mzr6-IqY6Yu5m4LFNdXnFCHQZYhsOfc2M_bYPQp2pYlX2XVSEVhrnSSbd1WrIZ5jek9GEyarNggel5WOjg4csX5hZXGXDRyTkRwaRDSMEPxR3qScRWgs-COR_aDhVn2oeBPfZ3DFgWNv62QpNm22TUNyPNF9ZG_PiGWrgUh4mQYoVoMnfIufAviRsGX_CSs98QbMxO0TdiPhNQ5V3iwrFLe49FisuWo5Dy2uAPe_ZvVmSqexBszweTD2snOXzqxlupIqhuzNDPNskleyDiJm0cc1rtE3iPFlui5duy6vfoYBqrjH0iZ-2Hus&sai=AMfl-YRXA0pAGH3BuIuXbOd-IcqPqyVUQP__fqOTQU-QHrFVw3go4GN10mxlP7gWGWGEJq57TBSpXiZN4Nn3ozFrrqVTKLWUPBswzgNIhlxLiJ8SHpfKAptEX5sTAzHHhg&sig=Cg0ArKJSzL_wk4AbmRDAEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:05 GMT
/
cds.taboola.com/ 		0
82 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cds.taboola.com/?uid=cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701&uad=7a099c226b965e0d1fb4ef2fa01159e1564cd73e3879178a0cd216e8abb901ff&mbl=ZmFsc2U=
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:05 GMT
cache-control
no-store
server
nginx
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 		254 B
687 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
date
Tue, 20 Jun 2023 19:44:05 GMT
via
1.1 varnish
x-amz-request-id
C4YX393BV63BMCS9
age
15624
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
hJZ9rVKYX0/8YTS367+n1JLWaWxjxwlUGV9luK6w6nrhJtmZXbtiGq/h5BjCJKdhOOZFYFppGpg=
x-served-by
cache-yyz4535-YYZ
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1687290245.183427,VS0,VE0
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
content-type
image/png
abp
94
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
2783
container.html
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 001A 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Wed, 19 Jun 2024 19:44:03 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
async_usersync
ib.adnxs.com/ Frame FD87 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1922&pub_id=2234281&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1922&pub_id=2234281
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:05 GMT
AN-X-Request-Uuid
4f975722-f35b-4999-8e65-7cdeb8180797
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ Frame 8DE5 		77 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
0c2bcf8f2cac8b0d68b5a92d6de41d8abc998664cbbd473af40ecece0674ace3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26347
x-xss-protection
0
server
cafe
etag
209 / 19528 / 31075490 / config-hash: 16396063179614486054
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:05 GMT
prebid7.19.0.js
hb.adpone.com/ Frame 8DE5 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3422
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S4f7%2F0EIdo8t5PzcBVfbSNyMXS%2ByYIzinFGnZI1byto8y4Y9xv3QFL37k3bX0bzb37R1tMQWMIhAa4Jwd3QA8A4Sf09LCw9HNGQlpwz21BihMx3RhbK9AJ7AHDswPTxj5GX3EtXTxn7xIKc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da681217e2b18d0-EWR
p.html
sopalk.com/r/ Frame 6EC3 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=ytduubyrq&e=1069342552190
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-47.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
44993
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 2ba01a121d51ee735a8dde7a86ed73b6.cloudfront.net (CloudFront)
x-amz-cf-id
SmhhVjSl57-ixYc3LSVcoT9yCaSnHBk3441BQI3jOgdFexjpqtEWdA==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 2CA4 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=xkarpqq&e=1069342552190
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-47.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
44993
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 2ba01a121d51ee735a8dde7a86ed73b6.cloudfront.net (CloudFront)
x-amz-cf-id
nkEo_b3klOnJUq1CRK4XSfekXTtCGRLpS926hTnLR-pAbf5fpYGLxw==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame F8A7 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=tcjtvkgl&e=1069342552190
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-47.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
44993
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 2ba01a121d51ee735a8dde7a86ed73b6.cloudfront.net (CloudFront)
x-amz-cf-id
drmhbnEkeJUDzxV8M9N6VSR_jxDDZF40agNUIcL9VliRGke13xyJjg==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 0E60 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=mpgdnr&e=1069342552190
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-47.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
44993
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 2ba01a121d51ee735a8dde7a86ed73b6.cloudfront.net (CloudFront)
x-amz-cf-id
-bX1AwuiQ4Uv1WMYjAqJIzZwNhUKiSW4PAxaeqiuL0ue5gmpmCZ7OQ==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame D813 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=ayavvzdyv&e=1069342552190
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-47.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
44993
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 2ba01a121d51ee735a8dde7a86ed73b6.cloudfront.net (CloudFront)
x-amz-cf-id
lxGLiSE4YUOHPFfAqqD0ooj1uc3Blkm3tqe9YrH-QeDfnAEufdqdGA==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 8D4D 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=mahwikxa&e=1069342552190
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-47.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
44993
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 2ba01a121d51ee735a8dde7a86ed73b6.cloudfront.net (CloudFront)
x-amz-cf-id
8dWJE9cqL2vp1ywikKOSYfGKrgdcUkqJifLFu0unuGam7GmU-1EvXA==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 9BD7 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=wfeqdiirq&e=1069342552190
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.47 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-47.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
44993
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 2ba01a121d51ee735a8dde7a86ed73b6.cloudfront.net (CloudFront)
x-amz-cf-id
woozwYvlVnD08lJWpTKw4oY7bSqSf21Lffj5N6qH6vupD66QKoUo6A==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
container.html
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 39DD 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Wed, 19 Jun 2024 19:44:03 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
log
protected-by.clarium.io/ Frame 001A 		0
0
log
protected-by.clarium.io/ Frame 001A 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 001A 		0
0
event-stream
k.p-n.io/ 		0
126 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://k.p-n.io/event-stream
Requested by
Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.64.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-64-172.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:05 GMT
access-control-allow-headers
*
access-control-max-age
600
access-control-allow-methods
*
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306150101/ Frame 8DE5 		411 KB
127 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306150101/pubads_impl.js?cb=31075490
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7f295fdb1019a3c2ff2479582f5eda1915c67e8d8634f8b089920f86b6cc4fb7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 06:48:45 GMT
content-encoding
br
x-content-type-options
nosniff
age
46520
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
129960
x-xss-protection
0
server
cafe
etag
10643696450713337328
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Wed, 19 Jun 2024 06:48:45 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ Frame 8DE5 		616 B
320 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.mercurynews.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ac888a811086e5e08352c3dc0d0b704206641c37f78b1932c3ca956367aed497
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:05 GMT
log
protected-by.clarium.io/ Frame 39DD 		0
0
log
protected-by.clarium.io/ Frame 39DD 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 39DD 		0
0
event-stream
k.p-n.io/ 		0
125 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://k.p-n.io/event-stream
Requested by
Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.64.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-64-172.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:05 GMT
access-control-allow-headers
*
access-control-max-age
600
access-control-allow-methods
*
index.js
cdn.pranmcpkx.com/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pranmcpkx.com/index.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/7991) /
Resource Hash
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
gzip
content-md5
nynBpfvYghYqzIzsvfssRw==
age
206467
x-cache
HIT
content-length
2382
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jun 2022 17:08:13 GMT
server
ECAcc (nya/7991)
etag
0x8DA5083F65AD9E0
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
x-ms-request-id
771178af-101e-005f-22ce-a14382000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3515810653216537&correlator=3646590751819869&eid=31074948%2C31075339&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=8&adks=1140109686&didk=1622125026&sfv=1-0-40&ris=1&rcs=2&prev_scp=pos%3DSponsorship_1%26confiant_refresh%3Dtrue%26htl_refresh%3D2&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D46f21ba418c8944f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_Mb9T8C51CxOA0VbrwUKyKOrzu4s6g&gpic=UID%3D00000c52bcfe7c0f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_MYm7YW-LLGO3cnvTDwuDeHDm2mpiw&abxe=1&dt=1687290245894&lmt=1687290245&dlt=1687290239156&idt=1771&adxs=3085&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=300x50&msz=300x50&fws=3076&ohw=1254&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvh-e_sq2mCgV31wYQf2-D5xS28_CvUtFNipQvNcJvoH3hBpvXXcoV44j9Ckd7lPYagvCN1qgPpEyYxSDFPp5LRnECZJx7q7&ga_vid=690102992.1687290241&ga_sid=1687290243&ga_hid=1249931897&ga_fc=true&ga_cid=1597915438.1687290241&a3p=EhkKCnVpZGFwaS5jb20Y-b_X0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRieyNfSjTFIAFICCGoSGQoKcHViY2lkLm9yZxjZw9fSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y-b_X0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e9093e9b56981654429a5fb67048b3a2b1fbd3d5307a08f5c080d646d682b8fb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13070
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
prebid7.19.0.js
hb.adpone.com/ Frame 6EC3 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=ytduubyrq&e=1069342552190
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3422
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JXZLYOcgFCLcAe%2BY0Gx9uwGGYvQYO2ptHxkF695lOdGd81XbwOxqtXTUazB6ftx0P9O3CNnn%2FFlgO3HreHG6FwFaBDTw9liP3L9us1mS6h2ouIkOO0mW3QYt1SHuKEgpGouCVMEmSTk1VIY%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6812549a718d0-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 2CA4 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=xkarpqq&e=1069342552190
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3422
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0mRgJM75%2Fu4hFYdYqierbb%2BAeI3up4tAQnhTOfC6jSaGYc%2BGlsAPa0r2JZ671koajhNZo%2Boovzuzv7P9mmynY25mtEVcRODyFQGmEyxY5AYJB5I1nETgNkF%2F8S8FUxwD8Skn7q0v6U6teio%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6812559ab18d0-EWR
openrtb
adx.adform.net/adx/ Frame 8DE5 		0
535 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
prebid
ib.adnxs.com/ut/v3/ Frame 8DE5 		15 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
63ff9dc8f7ee5076b45256023dd1071bb914f2b52d49749c01f52f150326f77e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:06 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
d2578dcb-b1ed-4808-8fed-52bb73b767ed
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 8DE5 		0
63 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:05 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
v1
prg.smartadserver.com/prebid/ Frame 8DE5 		1 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.145 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
f4fd43c5cac123f7e4194c8d3fea22fbe20ccc723cf6ca38362cc0297c27c08e

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame 8DE5 		0
312 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da68125fdcc4400-EWR
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cdb
bidder.criteo.com/ Frame 8DE5 		0
197 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=10519680691&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:05 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 8DE5 		0
0
prebid7.19.0.js
hb.adpone.com/ Frame F8A7 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tcjtvkgl&e=1069342552190
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3422
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZPyQT1d%2BVNqH9Yu4Orp046CplqTkDBKKgVpkvUPqr4JHcbxWzH1VA0ekrmy5opm2TDzuXSk9ayrA6bT8UhdBxQ7QAUKGkQrrllrHqSJ237ZvBHT3dp84qMKzw%2B0sh7%2BVNZXbXC0Bh%2FlgT50%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6812579c518d0-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 0E60 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=mpgdnr&e=1069342552190
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3423
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rYsLmudfJFcuK7ayGYCip1QTde0tPBhTFt57AiLwXi71PtTP3eei0wIKIn2uMThDprO2HxeMr%2B9IsLuFdSk3mcgpHiy6%2Fkv52m2tfUJIhmzXPM%2BvVotbCe7B4k%2F0vtpQLUqCgRCJgkf30j0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6812579c818d0-EWR
prebid7.19.0.js
hb.adpone.com/ Frame D813 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=ayavvzdyv&e=1069342552190
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3423
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y2QLnG%2BkHOSJagAnAq0drqUAdZFNpAiKMCz66OvcgGLoD4igpPxdvbOP8Rv3c7qM7apmcakhsBdrRDAp80Gyk5pFfU%2BSpIAc%2BCgNiQMy2q0gnywrONW%2B%2F9cW2R1hQoJXdmdjeejBkNMsCoQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6812589cc18d0-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 8D4D 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=mahwikxa&e=1069342552190
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3423
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h208tAvIsd9WXEV%2ByenkcfACmG%2BfZNOs0FeCrB2e%2FxFqYFFCkI8dZk%2FFchR6T2tRtYzICyh6Vs4GdmLFCCcDX0wKgDDQkCiCgaSfw17M7uypRFqQ%2Fh%2FJqHHM0BVttZUyflr33kmqBRzxnvI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6812599da18d0-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 9BD7 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=wfeqdiirq&e=1069342552190
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3423
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DFHr1eywysHW%2BIOJDxrNxf%2FlgHJhJgrZFfurFATv8R0aDeYKlr2D7%2BKu8FIrzsXziQJN%2Fa3NU8GDnqWUMEI8eGG%2BrHnhEa1vWZjJxKyoVIUi38hbT%2BzFOWmuBMPFI2MAGlskdRnyIO2N5kk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6812599df18d0-EWR
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3515810653216537&correlator=3820046390132226&eid=31074948%2C31075339&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Ctop_leaderboard&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=9&adks=142133714&didk=303353385&sfv=1-0-40&ris=1&rcs=2&prev_scp=pos%3Dtop_leaderboard%26confiant_refresh%3Dtrue%26htl_refresh%3D2&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D46f21ba418c8944f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_Mb9T8C51CxOA0VbrwUKyKOrzu4s6g&gpic=UID%3D00000c52bcfe7c0f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_MYm7YW-LLGO3cnvTDwuDeHDm2mpiw&abxe=1&dt=1687290246070&lmt=1687290246&dlt=1687290239156&idt=1771&adxs=1515&adys=323&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=970x90&msz=970x90&fws=1028&ohw=1280&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvh-e_sq2mCgV31wYQf2-D5xS28_CvUtFNipQvNcJvoH3hBpvXXcoV44j9Ckd7lPYagvCN1qgPpEyYxSDFPp5LRnECZJx7q7&ga_vid=690102992.1687290241&ga_sid=1687290243&ga_hid=1249931897&ga_fc=true&ga_cid=1597915438.1687290241&a3p=EhkKCnVpZGFwaS5jb20Y-b_X0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRieyNfSjTFIAFICCGoSGQoKcHViY2lkLm9yZxjZw9fSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y-b_X0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5ffab5e51399131eb22e55cc7405afb4bc4b2422cab0dc142d6383a19dac7642
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13055
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame 2390 		0
260 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
sync
ads.yieldmo.com/v000/
Redirect Chain
  • https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=image
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=yieldmo&ttd_tpi=1&ttd_puid=gb63ffdf5e8844fc2dd8
  • https://ads.yieldmo.com/v000/sync?tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
43 B
813 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
44.207.246.26 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-207-246-26.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ads.yieldmo.com/v000/sync?tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
181
rum
r.casalemedia.com/
Redirect Chain
  • https://dsum.casalemedia.com/pbusermatch?origin=prebid&site_id=945271&p=1&i=0&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=48
  • https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:06 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
server
A
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://r.casalemedia.com/rum?cm_dsp_id=64&external_user_id=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
xuid
eb2.3lift.com/
Redirect Chain
  • https://eb2.3lift.com/sync?px=1&src=prebid&us_privacy=1---&
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&dongle=0cfd&gdpr=0&gdpr_consent=
37 B
352 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:44:06 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://eb2.3lift.com/xuid?mid=3658&xuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&dongle=0cfd&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
251
SPug
image4.pubmatic.com/AdServer/
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=162935&us_privacy=1---
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&redir=true&gdpr=-1&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-mPTotEpE2uVjindUKBP5sJCUhB9yLyY-~A
0
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-mPTotEpE2uVjindUKBP5sJCUhB9yLyY-~A
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:05 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-mPTotEpE2uVjindUKBP5sJCUhB9yLyY-~A
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
prebid
ib.adnxs.com/ut/v3/ Frame 6EC3 		15 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
770e9e490a714f161fcdda1092ce520bbee93b7964543ae8504770f59348bc5a
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:06 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
21bb197f-06f5-4b90-bc69-e9ddce882ff3
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cdb
bidder.criteo.com/ Frame 6EC3 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=74916533605&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
openrtb
adx.adform.net/adx/ Frame 6EC3 		0
527 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
translator
hbopenbid.pubmatic.com/ Frame 6EC3 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:04 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 6EC3 		346 B
418 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290245952&tk_flint=pbjs_lite_v7.19.0&x_source.tid=4958a551-4452-46b4-84a6-3aa4de2c0a86&l_pb_bid_id=10d2461f8bb432a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.20243705860184358
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::116 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
b4ef7da471b1261442e541f8a301ba82df7031093b7092ddbb1677de527444a0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
v1
prg.smartadserver.com/prebid/ Frame 6EC3 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.145 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
cf20568a837b9f3871e57d70a7324da60b458aa58e5b9b74289dc319c3a90dcb

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame 6EC3 		0
50 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da681276f824400-EWR
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
prebid
ib.adnxs.com/ut/v3/ Frame 2CA4 		13 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
9c3cca60917c7728244dd474018bdf1c87df8af530770e92b6aef5f5708d7c89
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:06 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
bb1d3f88-9741-4d96-ac18-86e65e20c5a1
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame 2CA4 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:06 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame 2CA4 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da681277f954400-EWR
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
v1
prg.smartadserver.com/prebid/ Frame 2CA4 		947 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.145 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
58e3e66ae0356604d88fc7ffe4b1962b51b333586da8d54c42fa3c1ee53acb41

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 2CA4 		346 B
404 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290245956&tk_flint=pbjs_lite_v7.19.0&x_source.tid=82f841bc-6ec1-4907-97c2-a5c54dd8a2d4&l_pb_bid_id=1006584a6675306&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5019174206293464
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::116 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
51637839e823bd483e5de497c31073f2f98df12494a930fc904849595bf72ed6

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
openrtb
adx.adform.net/adx/ Frame 2CA4 		0
527 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
cdb
bidder.criteo.com/ Frame 2CA4 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=12925313791&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:05 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
cdb
bidder.criteo.com/ Frame F8A7 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=42701977129&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:05 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame F8A7 		346 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290245979&tk_flint=pbjs_lite_v7.19.0&x_source.tid=642a80a9-4bd5-4073-9deb-ab61c2d29f21&l_pb_bid_id=4dd0367f8fc73a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5471532922666
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::116 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
d626c98d96c73f2397b9e3113d1ef093f05250483897d4125d3fe421ce4da8e2

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:07 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
openrtb
adx.adform.net/adx/ Frame F8A7 		0
527 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
v1
prg.smartadserver.com/prebid/ Frame F8A7 		932 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.145 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
147d25e8517bdfabf13dd9398299b6ca9583d218e57ae2e9a1576cb3dc94e65c

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame F8A7 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da68128c91e4400-EWR
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
prebid
ib.adnxs.com/ut/v3/ Frame F8A7 		13 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
89970e3517ddce1c58be0161f4b566efe8707401b092de1579aec82b01cd4d68
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:06 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
c8ea11f9-14ed-45e7-ad2a-d2de7cc20ab9
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ Frame F8A7 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:05 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/ Frame 0E60 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:05 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame 0E60 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da68128d9304400-EWR
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 0E60 		346 B
404 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290245983&tk_flint=pbjs_lite_v7.19.0&x_source.tid=a7faebbd-3224-4896-b626-e4425a7829c5&l_pb_bid_id=66ba33a4a83434&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7459144662954929
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::116 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
4dd014d13c7aa676ae297ebf87b7bf656718fbf3eecd9bb794e9a6743a112524

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:13 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
openrtb
adx.adform.net/adx/ Frame 0E60 		0
527 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
cdb
bidder.criteo.com/ Frame 0E60 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=42573562772&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
prebid
ib.adnxs.com/ut/v3/ Frame 0E60 		138 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
b3eccc3acdf622eb62b23c8aa6829439e1d3e9e670c757b0539673873e68cbf6
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:06 GMT
AN-X-Request-Uuid
71e2ab98-2b42-4f42-9fe5-a77b186d0974
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
138
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
prg.smartadserver.com/prebid/ Frame 0E60 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.145 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
0fd81fe58c3f48e962de6a92e22e34ab3f89179c651874d87307abeeed9094c8

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame D813 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da68128e9564400-EWR
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame D813 		346 B
404 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290245986&tk_flint=pbjs_lite_v7.19.0&x_source.tid=0985912a-0185-474d-9800-38b3efb8c4c6&l_pb_bid_id=4bc10956ae2332&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.9988960017075406
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::116 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
a8f2fd64aefb16b857bd383e284f8fa54868176b1d006243914d1f95479aa3ad

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
translator
hbopenbid.pubmatic.com/ Frame D813 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:06 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ Frame D813 		138 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
3c49b33a0fcabeab1ad43b32ccaa44f730c0df05614b7001eb55c71abb29fdbd
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:06 GMT
AN-X-Request-Uuid
3f7cc9aa-32b1-4e6b-968d-0f2cfac0677b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
138
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cdb
bidder.criteo.com/ Frame D813 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=91375331833&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
v1
prg.smartadserver.com/prebid/ Frame D813 		998 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.145 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
57d795ebb29306258ea950b57deaec4d21898f886646f32f20b5e3e75d000523

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
openrtb
adx.adform.net/adx/ Frame D813 		0
527 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
/
prebid.smilewanted.com/ Frame 8D4D 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da6812909724400-EWR
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
openrtb
adx.adform.net/adx/ Frame 8D4D 		0
527 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
prebid
ib.adnxs.com/ut/v3/ Frame 8D4D 		13 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
7b761f4cb092d9d7a330ce8aa8379c1a3e92bf0df7cbd1ebf875e9e45fdef086
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:06 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
c5d01928-a36c-4254-92f6-19e4378dc4b6
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cdb
bidder.criteo.com/ Frame 8D4D 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=82328259989&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 8D4D 		346 B
404 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290245998&tk_flint=pbjs_lite_v7.19.0&x_source.tid=82fd54a5-5d46-49f7-a6d3-1874c441bfd4&l_pb_bid_id=10bf06950b6b0f2&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5997067224042476
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::116 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
e3d7ed7dd0b1b54509a0d0986c8ac346015db967344155f901a2dfb63c0dfb6a

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:07 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
v1
prg.smartadserver.com/prebid/ Frame 8D4D 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.145 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
d050ff373959aca7a28e6b8af392e1ef9097c5c3b78d1fc544c9fdc827fa20b3

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:05 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/ Frame 8D4D 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:05 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame 9BD7 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da6812929c14400-EWR
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
prebid
ib.adnxs.com/ut/v3/ Frame 9BD7 		12 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
ffbd2ddea8b43e195d7746233abc36e820a81bf3077f1a34fbc3cd214c4339bc
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:06 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
4139460b-8aa8-4eb3-8923-bdff2b8940b5
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cdb
bidder.criteo.com/ Frame 9BD7 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=69930363141&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
openrtb
adx.adform.net/adx/ Frame 9BD7 		0
527 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.254 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 9BD7 		12 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290246001&tk_flint=pbjs_lite_v7.19.0&x_source.tid=d1126224-2ddd-42c2-9340-9f8b3f17d4fd&l_pb_bid_id=100a40754102a6&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.4842279749108578
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::116 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
0a3641139a73693dfa9338ac65bad55975a611523388e41d821c8b1e1182c64d

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
content-encoding
gzip
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
expires
Wed, 17 Sep 1975 21:32:10 GMT
translator
hbopenbid.pubmatic.com/ Frame 9BD7 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:06 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
v1
prg.smartadserver.com/prebid/ Frame 9BD7 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.145 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
7c5c0f775d4e0b4ed66cf5e30e50d6f158bcce6dcae47bbab3d512be51d171ca

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:06 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
container.html
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 236C 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
3
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Wed, 19 Jun 2024 19:44:03 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C9FF 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
3
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Wed, 19 Jun 2024 19:44:03 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
script.js
acdn.adnxs-simple.com/strikeforce/ Frame D3CD 		122 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs-simple.com/strikeforce/script.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
f63b683b181032b37e4b8a3fe5d001edc0b40a8df47c66b7966e2e7242f0226d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:06 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 May 2023 16:21:53 GMT
Server
nginx/1.18.0 (Ubuntu)
ETag
W/"645bc4a1-1e7fc"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Length
43711
Expires
Wed, 21 Jun 2023 19:44:08 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame D3CD 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:44:06 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
456183
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12830-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687290247.769455,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 66343
it
nym1-ib.adnxs.com/ Frame D3CD 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQiGg8ikBhDwhKWi4f7ggBAYoZat_YGQwK8QKjYJEUn0Morldj8RBA63L997cT8ZAAAAgML18D8hBA63L997cT8pEkkJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXjEtgWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC-QUhTkoyUnV3amdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2dRWm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBWUZvNURDdE4zNF93UUh3S2kxQVFlRjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUhfOXY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZORFk1TS1BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCLhwQUVBWmdFQkxJRUNnamt3cGtORUtDenRBMjZCQm9JbmdrUktWeVB3dlVvekQ4WgVJCQEgZzVNS1pEY0VFGSAIX0pCCRwFARgyQVFEOFFRBQwFAfBSSUlGSHdpaHl5VVFCUmdCSWdORFFVUXBOank5VXBZaDlUOHhRbURsMENMYnlULUlCZFVra0FYQzlrNllCWmZhNG9jQnFRWFRwQlIwZTBudFA3RUYFWAUBCERCQh1rPHlRVUFBQUNnWXR6U1A5RUYFIwUBBERaFSi4UEFfNEFXdkJQQUYxcGlIQ3ZnRnJQM1FBb0lHQTBOQlJJZ0dCSkFHQVpnR0FLRUcFPwUBJENvQmdTeUJpUUoFDwkBAFIJBwUBAFoFBgkBAGgJBwEBPEM0QmdvLpoCxQEhR0NOcC0-_QIsTG1ybHdFZ0FDZ0FNHc1MT2dsT1dVMHlPalEyT1ROQTZVTko5NQQ5UgFbCQEAQh15BEJoOZkEOXAJIAEBBEJ4AQYJARRCNEFJSUKqlQEESkERmPSbAVBBX9gCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTc4qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDzEyOTE3I05ZTTI6NDY5M9oEAggB4AQB8ATspYrNAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjY0NTS4BgDBBgAAAAAAAPA_0AaeqwLaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gaHAQjC9k4SgAFLaFNBVlZvQUFBQURBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnQVFMQzB1Z2RJdjdXNkIxRHBRMWkyTW5FQUFBQUFBQUFBQUhnQWdRRUFBQUEp3VRJZ0JBSkFCQUpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAfEtgXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=b9b666f959af09bb83a91667e17f0723f5b901aa
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:06 GMT
AN-X-Request-Uuid
11e9a72a-0677-41fc-b735-c8a16d353afe
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
log
protected-by.clarium.io/ Frame 236C 		0
0
log
protected-by.clarium.io/ Frame 236C 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 236C 		0
0
log
protected-by.clarium.io/ Frame C9FF 		0
0
log
protected-by.clarium.io/ Frame C9FF 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame C9FF 		0
0
PugMaster
image6.pubmatic.com/AdServer/ Frame AD44 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=73157112&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
a1acc097ac669715d7ddb34d1045b1d34989c0c34a72ce3c97196008ccd1fbab

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:06 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
dcmads.js
www.googletagservices.com/dcm/ Frame 8832 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:58:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2759
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:58:08 GMT
apn
beacon.sojern.com/imp/ Frame 8832 		42 B
229 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.sojern.com/imp/apn?auc=368572435070827563&cr=396450240&seg=&st=0&bp=0.01882&pp=0.01882&aaid=&idfa=&ord=672780485
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
119.244.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date
Tue, 20 Jun 2023 19:44:07 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
vary
Accept-Encoding
content-type
image/gif
ca
choices.truste.com/ Frame 8832 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=672780485&sz=300x250&js=st_dapp
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.106.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-106-40.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 54798bbc2ce3e33c706761634ac87e48.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P3
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
918
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
HMGMUslK5VVPY0FSkRd_SEn0oP7ko63v7uC35SanTun-2B0ouhf67g==
expires
Mon, 26 Jul 1997 05:00:00 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame 8832 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:44:07 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
456184
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12830-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687290247.202971,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 66344
it
nym1-ib.adnxs.com/ Frame 8832 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QKeCvBMHgUAAAMA1gAFAQiGg8ikBhCr-JbT1NXbjgUYoZat_YGQwK8QKjYJMPoK0oxFkz8RIA-H6Z4cjT8ZAAAAgML18D8hIA-H6Z4cjT8pL_oJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlDAs4W9AVi5q5cBYABopq60AXj0qwWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNjc5NjIzOSwgMCk7dWYoJ2knLCA3ODcwNzg2LCAwKTt1ZignZycsIDE5ODQ5NDc5LCANKfCfcicsIDM5NjQ1MDI0MCwgMCk7kgKBBCFWbVczZWdpVC1wTWFFTUN6aGIwQkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFmbEZiSjVhUlpNX3dRSDVSV3llV2tXVFA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSENzdUFEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvME5UZ3o0QVBwUTRBRXhvN3RDWWdFekk3dENaQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ5gQUFBSWdGNXlPcEJkT2tGSFI3U2UwX3NRVQEaCQEYTUVGbXBtWgECEHVUX0pCATscSUN3RnNnXzAuKAAITmtGCTEAQSEIsGdCZG9POEFXSHdyc0otQVhQNTU0RGdnWURWVk5FaUFZQWtBWUJtQVlBb1FhYQFcPG1abTVQNmdHQkxJR0pBa0EVAQBCHcsEQmsVFwRBQx0YRExnR0NnLi6aApkBIWxoVUVSdzoFAjRMbXJsd0VnQUNnQU1acQFtYFptYmtfT2dsT1dVMHlPalExT0ROQTZVTkoRYgw4RDlSEQwMQUFCWh0MAGgdDABwHQwAeB0MDDRBSWs1ePRIAThEOC7YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE3OKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA44MTcwI05ZTTI6NDU4M9oEAggB4AQB8ATAs4W9AYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdGZKfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AboKdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAf0qwXSBw0JLjEAFNoHBggAEAE6ZAcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=e3091e25c661ec46996688add07ba148bfe20dfd
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:07 GMT
AN-X-Request-Uuid
9ad302a6-947e-4512-b7f4-325185587e97
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
1a
i.clean.gg/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://i.clean.gg/1a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.21.6 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://sopalk.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
1728000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/plain; charset=utf-8
date
Tue, 20 Jun 2023 19:44:07 GMT
server
nginx/1.21.6
via
1.1 google
1a
i.clean.gg/ Frame D3CD 		0
104 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://i.clean.gg/1a
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.21.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT
via
1.1 google
server
nginx/1.21.6
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
dcmads.js
www.googletagservices.com/dcm/ Frame D3CD 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:58:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2759
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:58:08 GMT
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3515810653216537&correlator=55830051760593&eid=31074948%2C31075339&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Ctop_leaderboard&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=10&adks=142133714&didk=303353385&sfv=1-0-40&ris=1&rcs=3&prev_scp=pos%3Dtop_leaderboard%26confiant_refresh%3Dtrue%26htl_refresh%3D3&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D46f21ba418c8944f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_Mb9T8C51CxOA0VbrwUKyKOrzu4s6g&gpic=UID%3D00000c52bcfe7c0f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_MYm7YW-LLGO3cnvTDwuDeHDm2mpiw&abxe=1&dt=1687290247327&lmt=1687290247&dlt=1687290239156&idt=1771&adxs=1515&adys=243&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=970x250&msz=970x250&fws=1028&ohw=1280&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvh-e_sq2mCgV31wYQf2-D5xS28_CvUtFNipQvNcJvoH3hBpvXXcoV44j9Ckd7lPYagvCN1qgPpEyYxSDFPp5LRnECZJx7q7&ga_vid=690102992.1687290241&ga_sid=1687290243&ga_hid=1249931897&ga_fc=true&ga_cid=1597915438.1687290241&a3p=EhkKCnVpZGFwaS5jb20Y-b_X0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRieyNfSjTFIAFICCGoSGQoKcHViY2lkLm9yZxjZw9fSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y-b_X0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
77e486a7a408a776660e91616f44c25c88731da84c3167624cca496a6a768e12
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12974
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-LMTT1ZNHB1&gtm=45je36e0&_p=1249931897&cid=690102992.1687290241&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=2&sid=1687290241&sct=1&seg=0&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:07 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
impl_v96.js
www.googletagservices.com/dcm/ Frame 8832 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:58:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42360
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 07:58:07 GMT
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 5AD9
Redirect Chain
  • https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=968062838393799511
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.162.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-162-216.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT

Redirect headers

content-length
95
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:06 GMT
location
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
dcm
s.amazon-adsystem.com/ Frame 7E2E 		43 B
855 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&redir=true&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:07 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
2YSKVGYG8HX2MDKG7TGC
ImgSync
image8.pubmatic.com/AdServer/ Frame 4759
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:c0d66492-0183-4f00-930f-e67415c7188d&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control
no-store, no-cache, private
date
Tue, 20 Jun 2023 19:44:05 GMT
location
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
ImgSync
image8.pubmatic.com/AdServer/ Frame 3ED2
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFEOExFN0pKQU1BQUItUS11NHNGUQ&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&b...
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csyn%2Csas%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAD8LE7JJAMAAB-Q-u4sFQ&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsyn%252Csas%252Cpm%26bee_sync_cur...
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=syn%2Csas%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAD8LE7JJAMAAB-Q-u4sFQ&pid=558502&do=add&gd...
  • https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AAD8LE7JJAMAAB-Q-u4sFQ&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsas%252Cpm%26bee_syn...
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=sas%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=3
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dpm%2...
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=pm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=4&userid=4614819635623485669&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control
no-store, no-cache, private
date
Tue, 20 Jun 2023 19:44:07 GMT
location
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 49CB
Redirect Chain
  • https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_997d12a216e84889bc024
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.162.216 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-162-216.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT

Redirect headers

content-length
95
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:06 GMT
location
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
ImgSync
image8.pubmatic.com/AdServer/ Frame 592D
Redirect Chain
  • https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1179662177681492769&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.32 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:06 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control
no-store, no-cache, private
date
Tue, 20 Jun 2023 19:44:06 GMT
location
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
usersync
usersync.gumgum.com/ Frame 4682 		35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=pbm&i=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-214-33-241.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:07 GMT
Expires
0
Pragma
no-cache
sd
us-u.openx.net/w/1.0/ Frame AD44 		43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=540245193&val=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:07 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT
Martin
crb.kargo.com/api/v1/dsync/ Frame AD44 		43 B
504 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://crb.kargo.com/api/v1/dsync/Martin?exid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.210.26.99 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-210-26-99.compute-1.amazonaws.com
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:07 GMT
X-Accel-Expires
0
Vary
Origin
Content-Type
image/gif
Cache-Control
no-cache, no-store, must-revalidate, private, max-age=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 UTC
sync
sync.bfmio.com/ Frame AD44 		0
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=187&uid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.205.175.196 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-205-175-196.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:06 GMT
syncMe
synchroscript.deliveryengine.adswizz.com/ Frame AD44 		0
397 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.246.81.142 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-246-81-142.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:07 GMT
X-Clacks-Overhead
GNU Terry Pratchett
X-Adswizz-request-id
d20d9c50-0fa2-11ee-afc2-06e26afb6ad1
Connection
keep-alive
Content-Length
0
X-Application-Context
application:production
Instance-id
i-035644328695a416f
8E87CD5E-E863-49F4-8101-49E63E3D4BD9
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame AD44 		43 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/8E87CD5E-E863-49F4-8101-49E63E3D4BD9?gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:b5c0:eead:85e9:361a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
Pug
simage2.pubmatic.com/AdServer/ Frame AD44
Redirect Chain
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=d50e1659d250559&is_secure=true&networkId=17100&version=1&nuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACG66zQrHM8QMaOwzmAAAAAAA&expiration=1687376647&nuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&...
42 B
346 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACG66zQrHM8QMaOwzmAAAAAAA&expiration=1687376647&nuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&is_secure=true&gdpr_consent=&gdpr=0
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:54:31 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:07 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAACG66zQrHM8QMaOwzmAAAAAAA&expiration=1687376647&nuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&is_secure=true&gdpr_consent=&gdpr=0
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
Pug
simage2.pubmatic.com/AdServer/ Frame AD44
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=880a98a2-e5e4-4836-b912-8db1e124443a&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33647_1049454A6_B75A6C7A&r=https://pmp.mxptint.net/sn.ashx?ak=1
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33647_1049454A6_B75A6C7A&r=https://pmp.mxptint.net/sn.ashx?ak=1
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33647_1049454A6_B75A6C7A&r=https://pmp.mxptint.net/sn.ashx?ak=1
Date
Tue, 20 Jun 2023 19:44:07 GMT
Cache-Control
private
Strict-Transport-Security
max-age=-370295030; includeSubDomains
P3P
CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length
302
Content-Type
text/html; charset=utf-8
Pug
simage2.pubmatic.com/AdServer/ Frame AD44
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://server.cpmstar.com/usersync.aspx?bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D440%26ss...
  • https://x.bidswitch.net/sync?dsp_id=440&ssp=pubmatic&user_id=hCrG6A0yBhVYst6iy0I_0
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd=
1 B
166 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:07 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd=
Date
Tue, 20 Jun 2023 19:44:07 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
impl_v96.js
www.googletagservices.com/dcm/ Frame D3CD 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:58:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42360
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 07:58:07 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3515810653216537&correlator=2682390142664383&eid=31074948%2C31075339&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=11&adks=1140109686&didk=1622125026&sfv=1-0-40&ris=2&rcs=3&prev_scp=pos%3DSponsorship_1%26confiant_refresh%3Dtrue%26htl_refresh%3D3&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D425393090679%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D46f21ba418c8944f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_Mb9T8C51CxOA0VbrwUKyKOrzu4s6g&gpic=UID%3D00000c52bcfe7c0f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_MYm7YW-LLGO3cnvTDwuDeHDm2mpiw&abxe=1&dt=1687290247437&lmt=1687290247&dlt=1687290239156&idt=1771&adxs=3085&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=300x50&msz=300x50&fws=3076&ohw=1254&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvh-e_sq2mCgV31wYQf2-D5xS28_CvUtFNipQvNcJvoH3hBpvXXcoV44j9Ckd7lPYagvCN1qgPpEyYxSDFPp5LRnECZJx7q7&ga_vid=690102992.1687290241&ga_sid=1687290243&ga_hid=1249931897&ga_fc=true&ga_cid=1597915438.1687290241&a3p=EhkKCnVpZGFwaS5jb20Y-b_X0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRieyNfSjTFIAFICCGoSGQoKcHViY2lkLm9yZxjZw9fSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y-b_X0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8183520fa4397ff540a38d153dfc93511291c9930f9bb099c1d5e205a8e99a9c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13028
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
B28666691.347415245;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=368572435070827563;crid=396450240;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24...
ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/ Frame 8832 		72 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B28666691.347415245;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=368572435070827563;crid=396450240;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=ddr88j;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FMPoK0oxFkz8gD4fpnhyNPwAAAIDC9fA_IA-H6Z4cjT8v-grSjEWTPyu8ZUqtbh0FIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAA6h8AAAIAAADAWaEXudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAcyKaAgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521lhUERwiT-pMaEMCzhb0BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjQ1ODNA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjQ1ODM%3D%2Fbn%3D87540%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=!5CUvW95hm;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=303;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.230 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s73-in-f6.1e100.net
Software
cafe /
Resource Hash
ab2d643da45088d90baa8f575d61ba7c31e3fc724cf8c1d4d605ebbb0b2a397c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:07 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30352
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
script.js
acdn.adnxs-simple.com/strikeforce/ Frame FE91 		122 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs-simple.com/strikeforce/script.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
f63b683b181032b37e4b8a3fe5d001edc0b40a8df47c66b7966e2e7242f0226d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:07 GMT
Content-Encoding
gzip
Last-Modified
Wed, 10 May 2023 16:21:53 GMT
Server
nginx/1.18.0 (Ubuntu)
ETag
W/"645bc4a1-1e7fc"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Length
43711
Expires
Wed, 21 Jun 2023 19:44:09 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame FE91 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:44:07 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
456184
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12830-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687290248.670938,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 66346
it
nym1-ib.adnxs.com/ Frame FE91 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLUCvQXAVQFAAADANYABQEIhoPIpAYQ6bT3kquu7tlgGKGWrf2BkMCvECo2Cc4aUG9TBZw_ET1YP1gDKpU_GQAAAIDC9fA_IWVyeZLFFKE_KVq77UJznaY_MQAAACCF67E_MO7fwQ04mFBAmDlIAlDW563TAVi5q5cBYABopq60AXjcpAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNjAzODY4OCwgMCk7dWYoJ2knLCA3MzYxODkwLCAwKTt1ZignZycsIDE4Mjk2ODA0LCAwKTt1ZigncycsIDI3NTYxOTAwMCwgMCk7dWYoJ3InLCA0NDMyNDk2MjIFVfCLkgKhBCF5bTRxVHdqUXVMQVpFTmJucmRNQkdBQWd1YXVYQVRBQ09BQkFBRWlZT1ZEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRcW9BUXF3QVFDNUFTT3htZWZzbktZX3dRRWpzWm5uN0p5bVA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUhpcXNFRDlRRzhYYk05bUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DSXl5dmlJUUN4Z0NMUUFBQUFDNkF3bE9XVTB5T2pZME16VGdBLWxEZ0FUZl80NExpQVRBOE5rSWtBUUJtQVFCd1EFNQkBCE1rRQkJAQEYRFlCQUR4QgELDQF4aUFXaU1wZ0Z1TG0yZ3dHcEJkT2tGSFI3U2UwX3NRVQUmHDB3emxQOEVGBQ0cTk1NMVRfSkIBYxxPQzFDdEVfMA0oBQEETmsJKCko8EBnQmNFaThBWGszOXdJLUFXZ3lmQUNnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkFrQQFIBQEAQh3HBEJrBRMFAQBDHRhETGdHQ2cuLpoCmQEhdlJiMnRBOiUCZExtcmx3RWdBQ2dBTWR2NWZtcThkTzhfT2dsPV0UUkE2VU5KBV0FxQQ5UgEICQEEQloJCAEBBEJoAQYJAQRCcAkIAQEEQngBBgkBEEI0QUlrNXD0SAE4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xNzioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjY0MzTaBAIIAeAEAfAE1uet0wGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWiiQf6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGqSXaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgH3KQF0gcNCS4xABTaBwYIABABOmQHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=e4003be7b5217fed355d63f0ea4c6ccb9bf45467
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:07 GMT
AN-X-Request-Uuid
545260db-def9-4066-898e-f59adf2914b6
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
B29652998.363876445;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=3bz84g;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEUn0Morldj8EDrcv33txPwAAAIDC9fA_BA63L997cT8SSfQyiuV2P3BCSRT2g...
ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/ Frame D3CD 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29652998.363876445;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=3bz84g;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FEUn0Morldj8EDrcv33txPwAAAIDC9fA_BA63L997cT8SSfQyiuV2P3BCSRT2gwEQIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAdTIAAAIAAADskqIZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoA8SEPxgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521GCNp-wjgh-IaEOylis0BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjQ2OTNA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo0Njkz%2Fbn%3D88900%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=!5CUvW95hm;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=282;prcl=s
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.65.230 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s73-in-f6.1e100.net
Software
cafe /
Resource Hash
7a5a973bdf6c962f88511085ae9b054e0acfd78103acb907677e8e81dd1f7f87
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:07 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29879
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 343C 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
4
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Wed, 19 Jun 2024 19:44:03 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame C1F2 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
4
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:03 GMT
expires
Wed, 19 Jun 2024 19:44:03 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
1a
i.clean.gg/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://i.clean.gg/1a
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.21.6 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://sopalk.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
1728000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/plain; charset=utf-8
date
Tue, 20 Jun 2023 19:44:07 GMT
server
nginx/1.21.6
via
1.1 google
1a
i.clean.gg/ Frame FE91 		0
15 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://i.clean.gg/1a
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.21.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 19:44:07 GMT
via
1.1 google
server
nginx/1.21.6
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
client
ssl.connextra.com/CFL/selector/ Frame 033E 		970 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssl.connextra.com/CFL/selector/client?client=CFL&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&_cb=2031217352&apnauc=6968116950742194793&bidid=6968116950742194793&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?zhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8./cca=NzMyMCNOWU0yOjY0MzQ=/bn=86620/clickenc=
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tcjtvkgl&e=1069342552190
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.69.48.172 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-69-48-172.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
9887fc8a93ecf96e2d9e31c13e0183839bdc8dc0344c7b0b3ab42bcb8d2aa0b4

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-length
640
content-type
text/html;charset=utf-8
date
Tue, 20 Jun 2023 19:44:08 GMT
expires
Tue, 20 Jun 2023 19:44:08 GMT
p3p
CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV
pragma
no-cache
server
istio-envoy
vary
* Accept-Encoding
x-envoy-upstream-service-time
3
x-served-by
adserver-blue-1
async_usersync.html
acdn.adnxs.com/dmp/ Frame 2135 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tcjtvkgl&e=1069342552190
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:07 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:09 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame FE91 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLrDPQXAWsGAAADANYABQEIhoPIpAYQ6bT3kquu7tlgGKGWrf2BkMCvECo2Cc4aUG9TBZw_ET1YP1gDKpU_GQAAAIDC9fA_IWVyeZLFFKE_KVq77UJznaY_MQAAACCF67E_MO7fwQ04mFBAmDlIAlDW563TAVi5q5cBYABopq60AXjcpAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNjAzODY4OCwgMCk7dWYoJ2knLCA3MzYxODkwLCAwKTt1ZignZycsIDE4Mjk2ODA0LCAwKTt1ZigncycsIDI3NTYxOTAwMCwgMCk7dWYoJ3InLCA0NDMyNDk2MjIFVfCLkgKhBCF5bTRxVHdqUXVMQVpFTmJucmRNQkdBQWd1YXVYQVRBQ09BQkFBRWlZT1ZEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRcW9BUXF3QVFDNUFTT3htZWZzbktZX3dRRWpzWm5uN0p5bVA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUhpcXNFRDlRRzhYYk05bUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DSXl5dmlJUUN4Z0NMUUFBQUFDNkF3bE9XVTB5T2pZME16VGdBLWxEZ0FUZl80NExpQVRBOE5rSWtBUUJtQVFCd1EFNQkBCE1rRQkJAQEYRFlCQUR4QgELDQF4aUFXaU1wZ0Z1TG0yZ3dHcEJkT2tGSFI3U2UwX3NRVQUmHDB3emxQOEVGBQ0cTk1NMVRfSkIBYxxPQzFDdEVfMA0oBQEETmsJKCko8EBnQmNFaThBWGszOXdJLUFXZ3lmQUNnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkFrQQFIBQEAQh3HBEJrBRMFAQBDHRhETGdHQ2cuLpoCmQEhdlJiMnRBOiUCZExtcmx3RWdBQ2dBTWR2NWZtcThkTzhfT2dsPV0UUkE2VU5KBV0FxQQ5UgEICQEEQloJCAEBBEJoAQYJAQRCcAkIAQEEQngBBgkBEEI0QUlrNXDgOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL_ICEQoGQURWX0lEEgc2aVcc8gISCgZDUEcBFAgIMThpQwEVCAVDUAEUFAkyNzU2MWFCOPICDQoIQURWX0ZSRVESAQkQHFJFTV9VU0VSBRAADAkgGENPREUSAPIBDwFZEQ8QCwoHQ1AVDhAQCgVJTwFhBAc3acwA8gEhBElPFSE4EwoPQ1VTVE9NX01PREVMASsUAPICGgoWMhYAHExFQUZfTkFNBXEIHgoaNh0ACEFTVAE-EElGSUVEAT4cFQoIU1BMSVQBTRnZ8IaAAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE3OKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NjQzNNoEAggB4AQB8ASlOiCIBQGYBQCgBf8RARgBwAUAyQUABQEU8D_SBQkJBQt8AAAA2AUB4AUB8AWiiQf6BQQIABAAkAYAmAYAuAYAwQYBITAAAPA_0AapJdoGFgoQCREZAaAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgH3KQF0gcNCREzATEI2gcGAWhwGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=99db5be7d4c6e509326de1105116258b16150850&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dtcjtvkgl%26e%3D1069342552190,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dtcjtvkgl%26e%3D1069342552190&
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:07 GMT
AN-X-Request-Uuid
f6d9d4dd-6b18-45fa-b0c8-f58d24ea7713
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
log
protected-by.clarium.io/ Frame 343C 		0
0
log
protected-by.clarium.io/ Frame 343C 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 343C 		0
0
express_html_inpage_rendering_lib_200_278.js
s0.2mdn.net/879366/ Frame 8832 		111 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:805::2006 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Origin
https://sopalk.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 09:07:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
38174
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39806
x-xss-protection
0
last-modified
Tue, 14 Mar 2023 18:44:05 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 21 Jun 2023 09:07:54 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame 8832 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B28666691.347415245;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;aucid=368572435070827563;crid=396450240;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=730607261;ord=ddr88j;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FMPoK0oxFkz8gD4fpnhyNPwAAAIDC9fA_IA-H6Z4cjT8v-grSjEWTPyu8ZUqtbh0FIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAA6h8AAAIAAADAWaEXudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAcyKaAgAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521lhUERwiT-pMaEMCzhb0BGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjQ1ODNA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjQ1ODM%3D%2Fbn%3D87540%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=!5CUvW95hm;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=303;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 16:53:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
10231
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 16:53:37 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 8832 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:59:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42281
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 07:59:27 GMT
ca
choices.trustarc.com/ Frame 8832 		27 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?sz=300x250&c=672780485&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=672780485&sz=300x250&js=st_dapp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
107b066b43b8cb84453e8682c17f57bffc22b78e1093993aebee11023e6b1839
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P1
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
0xhrmRlPJSedkB669ZsKibGJ5udKcgIoMi7cl4dc5GIHesEvRYTLHQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D3CD 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:08 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame D3CD 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 16:53:37 GMT
content-encoding
br
x-content-type-options
nosniff
age
10231
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 16:53:37 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame D3CD 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv4fg6X9mWq2rGF0OGHUUoKlvZCV78BbwmLWoEyLu5Hgeih2NvcfAH9xzFnNb9K_k9xg50ncDpbZGf_48EEWOR2_xyJdG5JfQGgiBW8Zjy7zv3nF2ElsRwNbbukCWS5R6tF_QbGuaVzcIOFfCTSu0IZOqkCAbwE9Ou9s50CFcv_w8c&sai=AMfl-YRWr7Ozrnv8AXpNCGGccVBFPZvT3wHujXL_ei_-YU3Q0Q1ii08_EQP6bjv564rwlky5W-RsfCTdnkDzYjJIL3fjTmuOW2P7PIQvfw&sig=Cg0ArKJSzMQ8xnqnvnp4EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230615.64615&arae=0&ftch=1&adurl=
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.13.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yul02s04-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:08 GMT
dvtp_src.js
cdn.doubleverify.com/ Frame D3CD 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:08 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 14:39:49 GMT
Server
UploadServer
ETag
"6bbda2156609c9b24e1e0e365f01b513"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3374
Expires
Sun, 18 Jun 2023 14:55:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame D3CD 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:59:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42281
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 07:59:27 GMT
13481351336222288159
s0.2mdn.net/simgad/ Frame D3CD 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/13481351336222288159
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=ytduubyrq&e=1069342552190
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:805::2006 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e5477888a979c7b864fafa6a3de860371886602af3e9d0be3f838e7c10dd5500
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 03:05:01 GMT
x-content-type-options
nosniff
age
319147
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37802
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 19:19:20 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 16 Jun 2024 03:05:01 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame BC73 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=ytduubyrq&e=1069342552190
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:08 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:10 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame D3CD 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKJEPBMCQgAAAMA1gAFAQiGg8ikBhDwhKWi4f7ggBAYoZat_YGQwK8QKjYJEUn0Morldj8RBA63L997cT8ZAAAAgML18D8hBA63L997cT8pEkkJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXjEtgWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC-QUhTkoyUnV3amdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2dRWm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBWUZvNURDdE4zNF93UUh3S2kxQVFlRjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUhfOXY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZORFk1TS1BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCLhwQUVBWmdFQkxJRUNnamt3cGtORUtDenRBMjZCQm9JbmdrUktWeVB3dlVvekQ4WgVJCQEgZzVNS1pEY0VFGSAIX0pCCRwFARgyQVFEOFFRBQwFAfBSSUlGSHdpaHl5VVFCUmdCSWdORFFVUXBOank5VXBZaDlUOHhRbURsMENMYnlULUlCZFVra0FYQzlrNllCWmZhNG9jQnFRWFRwQlIwZTBudFA3RUYFWAUBCERCQh1rPHlRVUFBQUNnWXR6U1A5RUYFIwUBBERaFSi4UEFfNEFXdkJQQUYxcGlIQ3ZnRnJQM1FBb0lHQTBOQlJJZ0dCSkFHQVpnR0FLRUcFPwUBJENvQmdTeUJpUUoFDwkBAFIJBwUBAFoFBgkBAGgJBwEBPEM0QmdvLpoCxQEhR0NOcC0-_QIsTG1ybHdFZ0FDZ0FNHc1MT2dsT1dVMHlPalEyT1ROQTZVTko5NQA5HXkAQh15BEJoOZkEOXABfwkBBEJ4CQgBARRCNEFJSUKqlQEESkERmPBeUEFf2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20v8gIRCgZBRFZfSUQSBzU1MjEwNjjyAhIKBkNQR19JRBIIMjEwODkzNjbyAhIKBUNQX0lEEgmVRhDyAg0KCAE-GEZSRVESATAFEBxSRU1fVVNFUgUQAAwJIBhDT0RFEgDyAQ8IQ1BHFQ8QCwoHQ1AVDhQQCgVJT18BiQA4idAA8gEhBElPFSE4EwoPQ1VTVE9NX01PREVMASsUAPICGgoWMhYAHExFQUZfTkFNBXEIHgoaNh0ACEFTVAE-EElGSUVEAT4cFQoIU1BMSVQBTQAJFdnwsIADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTc4qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDzEyOTE3I05ZTTI6NDY5M9oEAggB4AQB8ATspYrNAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAUMwAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo2NDU0uAYAwQYJNizwP9AGnqsC2gYWChAJEhkBYBAAGADgBgHyBocBCML2ThKAAUtoU0FWVm9BouBEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpMk1uRUEBPQUBEEhnQWdRHRBMSWdCQUpBQkFKb0JBZ2dBcUFFQXMuIAB8QS4ugAcBiAcAoAcBugcIKgQxLS0tQAHIB8S2BdIHDQkRuQG3CNoHBiEBcBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=5436c3365de00602f7425ae282e9203ad2788023&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dytduubyrq%26e%3D1069342552190,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dytduubyrq%26e%3D1069342552190&
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:08 GMT
AN-X-Request-Uuid
8d0becf4-b782-4465-9995-fdbcd7a9f520
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
log
protected-by.clarium.io/ Frame C1F2 		0
0
log
protected-by.clarium.io/ Frame C1F2 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.73.233 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-73-233.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame C1F2 		0
0
controller
ssl.connextra.com/servlet/ Frame 7A0A 		1 KB
854 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=6968116950742194793&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FzhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjY0MzQ%3D%2Fbn%3D86620%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=6968116950742194793&_cb=2031217352
Requested by
Host: ssl.connextra.com
URL: https://ssl.connextra.com/CFL/selector/client?client=CFL&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&_cb=2031217352&apnauc=6968116950742194793&bidid=6968116950742194793&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?zhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8./cca=NzMyMCNOWU0yOjY0MzQ=/bn=86620/clickenc=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.69.48.172 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-69-48-172.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
b3d0a0b4d857b709736ab97f8ae450f34c96e6e6a5422388708177747ea34f13

Request headers

Referer
https://ssl.connextra.com/CFL/selector/client?client=CFL&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&_cb=2031217352&apnauc=6968116950742194793&bidid=6968116950742194793&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?zhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA./bcr=AAAAAAAA8D8=/cnd=%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8./cca=NzMyMCNOWU0yOjY0MzQ=/bn=86620/clickenc=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-encoding
gzip
content-length
677
content-type
text/html;charset=UTF-8
date
Tue, 20 Jun 2023 19:44:08 GMT
expires
Tue, 20 Jun 2023 19:47:39 GMT
server
istio-envoy
vary
Accept-Encoding
x-envoy-upstream-service-time
2
x-served-by
adserver-blue-6
view
googleads4.g.doubleclick.net/pcs/ Frame D3CD 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv4fg6X9mWq2rGF0OGHUUoKlvZCV78BbwmLWoEyLu5Hgeih2NvcfAH9xzFnNb9K_k9xg50ncDpbZGf_48EEWOR2_xyJdG5JfQGgiBW8Zjy7zv3nF2ElsRwNbbukCWS5R6tF_QbGuaVzcIOFfCTSu0IZOqkCAbwE9Ou9s50CFcv_w8c&sai=AMfl-YRWr7Ozrnv8AXpNCGGccVBFPZvT3wHujXL_ei_-YU3Q0Q1ii08_EQP6bjv564rwlky5W-RsfCTdnkDzYjJIL3fjTmuOW2P7PIQvfw&sig=Cg0ArKJSzMQ8xnqnvnp4EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=319&vt=11&dtpt=317&dett=2&cstd=0&cisv=r20230615.64615&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.13.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yul02s04-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:08 GMT
async_usersync
ib.adnxs.com/ Frame 2135 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:08 GMT
AN-X-Request-Uuid
c6ea0fdc-792a-4bb7-b106-b2aa0e9dbe9c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ca
choices.truste.com/ Frame 8832 		28 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=28666691&js=st0
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.106.40 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-106-40.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
a39def26a2cee84287e689cd445d880ef7dd744ed43974ff75bcc5b376b2e123
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 54798bbc2ce3e33c706761634ac87e48.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P3
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
8032
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
mbIdJF8frPJi_jDeVVgPasmFGpXsKivunio1qgvcZvzC6TQWttis8g==
expires
Mon, 26 Jul 1997 05:00:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 8832 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:08 GMT
index.html
s0.2mdn.net/sadbundle/14000621282275070897/ Frame 385F 		22 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4020:805::2006 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6427d1eba7c9030eb9adfa1f78065baaa768d935979384935676d60f1b21374d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
350243
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5010
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Fri, 16 Jun 2023 18:26:45 GMT
expires
Sat, 15 Jun 2024 18:26:45 GMT
last-modified
Wed, 28 Sep 2022 17:05:58 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
googleads4.g.doubleclick.net/pcs/ Frame 8832 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstYbk309DJ6DEKvd_TYbfpA1ShLX9GMDojrkNQhxkbWw0P7ND6HG2oZnqiMnZ9hnviUqYRZOYYdIvNQEadrRAfUHq5lOrrgAuE1o0JPMmT0Plfd3yZfhMy8ki07cjh8DjFu88WQiNkcLvEsiqfZNCM_klKvsQOQVcMOKAXoFS4a&sai=AMfl-YRfr9unreniGWboZtODvuCG5Qjultuwx0kPxA046bL3PGCCop1QAJQFt9gJfRGs8SMOl0ma7g8C1t64FjpMNkQ6Ak2LbxBsWvw-Bw&sig=Cg0ArKJSzObzUKvVlw1oEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=395&cbvp=1&cstd=391&cisv=r20230615.66429&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.13.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yul02s04-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:08 GMT
dcm
beacon.sojern.com/imp/ Frame 8832 		42 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.sojern.com/imp/dcm?auc=368572435070827563&io=${INSERTION_ORDER_ID}&li=${CAMPAIGN_ID}&cr=396450240&io=${INSERTION_ORDER_ID}&seg=${PIXEL_ID_COMMA}&src=${SOURCE_URL}&ord=%c
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=mahwikxa&e=1069342552190
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
119.244.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date
Tue, 20 Jun 2023 19:44:08 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
vary
Accept-Encoding
content-type
image/gif
px
secure.adnxs.com/ Frame 8832
Redirect Chain
  • https://pixel.sojern.com/pixel/img/291730?p_v=1&f_v=v3_image&vid=hot
  • https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=i0oiyxswN32k7uFulsIA5w&google_nid=sojern__adx_open_bidder_seat&sjrn_id=UYQdtTQc4KALWt5Ce5XO5YqbMj8ZCcNj08bZoW3aV0axAFRET7XrAdcxsgBu0W21&s...
  • https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=UYQdtTQc4KALWt5Ce5XO5YqbMj8ZCcNj08bZoW3aV0axAFRET7XrAdcxsgBu0W21&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_...
  • https://secure.adnxs.com/px?id=1528961&t=1
0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.adnxs.com/px?id=1528961&t=1
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=mahwikxa&e=1069342552190
Protocol
HTTP/1.1
Server
68.67.160.26 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:08 GMT
AN-X-Request-Uuid
b515c9a2-7790-4e6e-8f28-adbf8e5346df
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/javascript; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

date
Tue, 20 Jun 2023 19:44:08 GMT
via
1.1 google
vary
Accept-Encoding
content-type
image/gif
location
https://secure.adnxs.com/px?id=1528961&t=1
p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
Utils_v9-long.js
ssl.connextra.com/services/ActiveAd/ Frame 7A0A 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.connextra.com/services/ActiveAd/Utils_v9-long.js
Requested by
Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=6968116950742194793&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FzhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjY0MzQ%3D%2Fbn%3D86620%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=6968116950742194793&_cb=2031217352
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.69.48.172 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-69-48-172.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
93e6639c3f07cb77467754907778fc49a74b1194368a93923c824ebec4d78298

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=6968116950742194793&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FzhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjY0MzQ%3D%2Fbn%3D86620%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=6968116950742194793&_cb=2031217352
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
gzip
last-modified
Mon, 07 Jun 2010 11:57:50 GMT
server
AkamaiNetStorage
etag
"159f636ee9f642a0c8c12354adf10d7c:1275911870"
vary
Accept-Encoding
content-type
application/x-javascript
accept-ranges
bytes
content-length
1742
vevent
nym1-ib.adnxs.com/ Frame FE91 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLUCvQXAVQFAAADANYABQEIhoPIpAYQ6bT3kquu7tlgGKGWrf2BkMCvECo2Cc4aUG9TBZw_ET1YP1gDKpU_GQAAAIDC9fA_IWVyeZLFFKE_KVq77UJznaY_MQAAACCF67E_MO7fwQ04mFBAmDlIAlDW563TAVi5q5cBYABopq60AXjcpAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNjAzODY4OCwgMCk7dWYoJ2knLCA3MzYxODkwLCAwKTt1ZignZycsIDE4Mjk2ODA0LCAwKTt1ZigncycsIDI3NTYxOTAwMCwgMCk7dWYoJ3InLCA0NDMyNDk2MjIFVfCLkgKhBCF5bTRxVHdqUXVMQVpFTmJucmRNQkdBQWd1YXVYQVRBQ09BQkFBRWlZT1ZEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRcW9BUXF3QVFDNUFTT3htZWZzbktZX3dRRWpzWm5uN0p5bVA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUhpcXNFRDlRRzhYYk05bUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DSXl5dmlJUUN4Z0NMUUFBQUFDNkF3bE9XVTB5T2pZME16VGdBLWxEZ0FUZl80NExpQVRBOE5rSWtBUUJtQVFCd1EFNQkBCE1rRQkJAQEYRFlCQUR4QgELDQF4aUFXaU1wZ0Z1TG0yZ3dHcEJkT2tGSFI3U2UwX3NRVQUmHDB3emxQOEVGBQ0cTk1NMVRfSkIBYxxPQzFDdEVfMA0oBQEETmsJKCko8EBnQmNFaThBWGszOXdJLUFXZ3lmQUNnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkFrQQFIBQEAQh3HBEJrBRMFAQBDHRhETGdHQ2cuLpoCmQEhdlJiMnRBOiUCZExtcmx3RWdBQ2dBTWR2NWZtcThkTzhfT2dsPV0UUkE2VU5KBV0FxQQ5UgEICQEEQloJCAEBBEJoAQYJAQRCcAkIAQEEQngBBgkBEEI0QUlrNXD0SAE4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xNzioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjY0MzTaBAIIAeAEAfAE1uet0wGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWiiQf6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGqSXaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgH3KQF0gcNCS4xABTaBwYIABABOmQHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=e4003be7b5217fed355d63f0ea4c6ccb9bf45467&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7756278961844469817&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&cid=3&cr=nv&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:08 GMT
AN-X-Request-Uuid
ca33b484-097d-47a3-a823-be049ac3b845
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
views
prod-dfm-proxy-connext.azurewebsites.net/api/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=b703beb6a13d3dbad7335e1ae9a1af96&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:08 GMT
X-Powered-By
ASP.NET
views
prod-dfm-proxy-connext.azurewebsites.net/api/ 		90 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=b703beb6a13d3dbad7335e1ae9a1af96&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Requested by
Host: cdn.czx5eyk0exbhwp43ya.biz
URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9

Request headers

source-system
Plugin
site-code
DFM
autoqa
false
accept-language
en-CA,en;q=0.9
settingskey
BANG,MERC
authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NTkyOTAyNDF9.1xGzPkvMByCpbBPhHX6yqb4MapCEBEieVmzCkvdK1EY
ssid
4e8ccc76dcfe04e8ba674086dff8eba3
environment
prod
config-code
BANGWPPRODWAB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
application/json
access-control-allow-origin
*
accept
application/json
attr
MERC
location
System
Referer
https://www.mercurynews.com/
version
Version: 2.8.5

Response headers

Expires
-1
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:08 GMT
Content-Encoding
gzip
X-Server-Time
6/20/2023 7:44:09 PM
Server
Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Content-Length
193
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
integrator.js
adservice.google.com/adsid/ Frame 8DE5 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame 8DE5 		35 KB
14 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2881518130063934&correlator=1498513083073087&eid=31075487%2C31075490&output=ldjh&gdfp_req=1&vrg=202306150101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=21671350435%3A208595991%2C300x250-mercurynews.com&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&adks=187146907&didk=1653906094&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D46f21ba418c8944f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_Mb9T8C51CxOA0VbrwUKyKOrzu4s6g&gpic=UID%3D00000c52bcfe7c0f%3AT%3D1687290243%3ART%3D1687290243%3AS%3DALNI_MYm7YW-LLGO3cnvTDwuDeHDm2mpiw&abxe=1&dt=1687290248637&lmt=1687290248&dlt=1687290245254&idt=757&adxs=2338&adys=874&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=tmvn6tsagppm&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=2&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&top=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=23&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&ea=0&ga_vid=1597915438.1687290241&ga_sid=1687290249&ga_hid=1567171656&ga_fc=true&a3p=EhkKCnVpZGFwaS5jb20Y-b_X0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRieyNfSjTFIAFICCGoSGQoKcHViY2lkLm9yZxjZw9fSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y-b_X0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306150101/pubads_impl.js?cb=31075490
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
00c5ac1bd4e9c9bb41e4d5c5c475c85acc964b1017eb72a152598e91c86854c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14566
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 8DE5 		15 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306150101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306150101/pubads_impl.js?cb=31075490
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3b382b0d9b44215db119e3a25e77d61eb223330108a79f83ee18207c4c17cd1a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11242
x-xss-protection
0
container.html
7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 086E 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:08 GMT
expires
Wed, 19 Jun 2024 19:44:08 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
async_usersync.html
acdn.adnxs.com/dmp/ Frame A93C 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=mahwikxa&e=1069342552190
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:08 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:10 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame 8832 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLTDPBMUwYAAAMA1gAFAQiGg8ikBhCr-JbT1NXbjgUYoZat_YGQwK8QKjYJMPoK0oxFkz8RIA-H6Z4cjT8ZAAAAgML18D8hIA-H6Z4cjT8pL_oJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlDAs4W9AVi5q5cBYABopq60AXj0qwWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNjc5NjIzOSwgMCk7dWYoJ2knLCA3ODcwNzg2LCAwKTt1ZignZycsIDE5ODQ5NDc5LCANKfCfcicsIDM5NjQ1MDI0MCwgMCk7kgKBBCFWbVczZWdpVC1wTWFFTUN6aGIwQkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFmbEZiSjVhUlpNX3dRSDVSV3llV2tXVFA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSENzdUFEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvME5UZ3o0QVBwUTRBRXhvN3RDWWdFekk3dENaQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ5gQUFBSWdGNXlPcEJkT2tGSFI3U2UwX3NRVQEaCQEYTUVGbXBtWgECEHVUX0pCATscSUN3RnNnXzAuKAAITmtGCTEAQSEIsGdCZG9POEFXSHdyc0otQVhQNTU0RGdnWURWVk5FaUFZQWtBWUJtQVlBb1FhYQFcPG1abTVQNmdHQkxJR0pBa0EVAQBCHcsEQmsVFwRBQx0YRExnR0NnLi6aApkBIWxoVUVSdzoFAjRMbXJsd0VnQUNnQU1acQFtYFptYmtfT2dsT1dVMHlPalExT0ROQTZVTkoRYgw4RDlSEQwMQUFCWh0MAGgdDABwHQwAeB0MDDRBSWs1eOA4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20v8gIRCgZBRFZfSUQSBzZpIRzyAhIKBkNQRwEUAAhxDRjyAgoKBUNQARQ4ATDyAg0KCEFEVl9GUkVRERAcUkVNX1VTRVIFEAARCSA8Q09ERRIFMzMyMTjyAiMKCAFWBRQYFzAwazViMAEBTFdzTVdwQUFOX2VuXzPyAgsKB0NQCSUcAPICEAoFSU8BdQQHN2mqGPICHQoHSU8JIQwSMDA2DUZgeFpGNFNBQVfyAhMKD0NVU1RPTV9NT0RFTAE9FADyAhoKFjIWACBMRUFGX05BTUUBHQgeCho2HQAIQVNUAT4QSUZJRUQBIRwNCghTUExJVAFN8JoBMIADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTc4qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjgxNzAjTllNMjo0NTgz2gQCCAHgBAHwBMCzhb0BiAUBmAUAoAX______wEFGAHABQDJBQAFARTwP9IFCQkFC3wAAADYBQHgBQHwBdGZKfoFBAgAEACQBgCYBgC4BgDBBgEhMAAA8D_QBugp2gYWChAJERkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAf0qwXSBw0JETMBMQjaBwYBaHAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=35c2f2b533c5c4b2d7516952913f5585edae989c&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dmahwikxa%26e%3D1069342552190,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dmahwikxa%26e%3D1069342552190&
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=mahwikxa&e=1069342552190
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:08 GMT
AN-X-Request-Uuid
9f220495-ac3a-4a01-b9ee-7cb8cc2b2841
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame BC73 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:08 GMT
AN-X-Request-Uuid
b56ef1cf-ca6c-461a-9190-6813be9f94ca
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
501ef24f75c19d412e4921509dd720dd.js
s0.2mdn.net/sadbundle/14000621282275070897/ Frame 385F 		90 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/14000621282275070897/501ef24f75c19d412e4921509dd720dd.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:805::2006 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
811f138b528716e41195f088d8a05969a76e5d03198289c0e9bb866d55ce30dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 18:26:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
350243
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
25932
x-xss-protection
0
last-modified
Wed, 28 Sep 2022 17:05:58 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 15 Jun 2024 18:26:45 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 0283 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
49924
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 05:52:04 GMT
expires
Wed, 19 Jun 2024 05:52:04 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
dv-measurements3941.js
cdn.doubleverify.com/ Frame D4EB 		536 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-measurements3941.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:08 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 10:24:03 GMT
Server
UploadServer
ETag
"245897220fbd1a0dfa41e714a5e3acf6"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=946080900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103853
Expires
Mon, 17 Jun 2024 10:24:07 GMT
vevent
nym1-ib.adnxs.com/ Frame D3CD 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQiGg8ikBhDwhKWi4f7ggBAYoZat_YGQwK8QKjYJEUn0Morldj8RBA63L997cT8ZAAAAgML18D8hBA63L997cT8pEkkJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXjEtgWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC-QUhTkoyUnV3amdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2dRWm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBWUZvNURDdE4zNF93UUh3S2kxQVFlRjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUhfOXY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZORFk1TS1BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCLhwQUVBWmdFQkxJRUNnamt3cGtORUtDenRBMjZCQm9JbmdrUktWeVB3dlVvekQ4WgVJCQEgZzVNS1pEY0VFGSAIX0pCCRwFARgyQVFEOFFRBQwFAfBSSUlGSHdpaHl5VVFCUmdCSWdORFFVUXBOank5VXBZaDlUOHhRbURsMENMYnlULUlCZFVra0FYQzlrNllCWmZhNG9jQnFRWFRwQlIwZTBudFA3RUYFWAUBCERCQh1rPHlRVUFBQUNnWXR6U1A5RUYFIwUBBERaFSi4UEFfNEFXdkJQQUYxcGlIQ3ZnRnJQM1FBb0lHQTBOQlJJZ0dCSkFHQVpnR0FLRUcFPwUBJENvQmdTeUJpUUoFDwkBAFIJBwUBAFoFBgkBAGgJBwEBPEM0QmdvLpoCxQEhR0NOcC0-_QIsTG1ybHdFZ0FDZ0FNHc1MT2dsT1dVMHlPalEyT1ROQTZVTko5NQQ5UgFbCQEAQh15BEJoOZkEOXAJIAEBBEJ4AQYJARRCNEFJSUKqlQEESkERmPSbAVBBX9gCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTc4qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDzEyOTE3I05ZTTI6NDY5M9oEAggB4AQB8ATspYrNAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjY0NTS4BgDBBgAAAAAAAPA_0AaeqwLaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gaHAQjC9k4SgAFLaFNBVlZvQUFBQURBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnQVFMQzB1Z2RJdjdXNkIxRHBRMWkyTW5FQUFBQUFBQUFBQUhnQWdRRUFBQUEp3VRJZ0JBSkFCQUpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAfEtgXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=b9b666f959af09bb83a91667e17f0723f5b901aa&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7756278961844469817&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:08 GMT
AN-X-Request-Uuid
01ff60d2-8f8d-4f99-86bb-0d24b5d0491d
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame AA36 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
49924
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 05:52:04 GMT
expires
Wed, 19 Jun 2024 05:52:04 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 8DE5 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:44:08 GMT
300x250.jpg
ssl.connextra.com/resources/CFL/2023/F2P_ACQ_US_CA_FantasyEvergreenV1Jun2023/ Frame 7A0A 		34 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.connextra.com/resources/CFL/2023/F2P_ACQ_US_CA_FantasyEvergreenV1Jun2023/300x250.jpg
Requested by
Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=6968116950742194793&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FzhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjY0MzQ%3D%2Fbn%3D86620%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=6968116950742194793&_cb=2031217352
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.69.48.172 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-69-48-172.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
112e4437cd11cf2bb4596bd53bf208420b24ee7f5532c92879e23f82c64c77e4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=6968116950742194793&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FzhpQb1MFnD89WD9YAyqVPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mP2naXbJyubNgIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAGCMEEQAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRb2tAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjY0MzRA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjY0MzQ%3D%2Fbn%3D86620%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=6968116950742194793&_cb=2031217352
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
PBXiw.Qmuo1yAEVVqnW1RyV9M0F6XHYK
date
Tue, 20 Jun 2023 19:44:08 GMT
last-modified
Mon, 05 Jun 2023 08:13:01 GMT
server
AmazonS3
x-amz-request-id
PJQMG3E7R1BWQGMP
etag
"aaf8504da3fc774fdf365fa2eaf9fe04"
x-amz-server-side-encryption
AES256
content-type
image/jpeg
accept-ranges
bytes
content-length
35249
x-amz-id-2
9LFQCxngrl9CLrQJERODe5iSSAIqKD0oPvepKR1teGDsCxN22inrZhBKmx1o/1X4tciqPgsZgmXKVTWEz7j+nA==
vevent
nym1-ib.adnxs.com/ Frame 8832 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKeCvBMHgUAAAMA1gAFAQiGg8ikBhCr-JbT1NXbjgUYoZat_YGQwK8QKjYJMPoK0oxFkz8RIA-H6Z4cjT8ZAAAAgML18D8hIA-H6Z4cjT8pL_oJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlDAs4W9AVi5q5cBYABopq60AXj0qwWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNjc5NjIzOSwgMCk7dWYoJ2knLCA3ODcwNzg2LCAwKTt1ZignZycsIDE5ODQ5NDc5LCANKfCfcicsIDM5NjQ1MDI0MCwgMCk7kgKBBCFWbVczZWdpVC1wTWFFTUN6aGIwQkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFmbEZiSjVhUlpNX3dRSDVSV3llV2tXVFA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSENzdUFEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvME5UZ3o0QVBwUTRBRXhvN3RDWWdFekk3dENaQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ5gQUFBSWdGNXlPcEJkT2tGSFI3U2UwX3NRVQEaCQEYTUVGbXBtWgECEHVUX0pCATscSUN3RnNnXzAuKAAITmtGCTEAQSEIsGdCZG9POEFXSHdyc0otQVhQNTU0RGdnWURWVk5FaUFZQWtBWUJtQVlBb1FhYQFcPG1abTVQNmdHQkxJR0pBa0EVAQBCHcsEQmsVFwRBQx0YRExnR0NnLi6aApkBIWxoVUVSdzoFAjRMbXJsd0VnQUNnQU1acQFtYFptYmtfT2dsT1dVMHlPalExT0ROQTZVTkoRYgw4RDlSEQwMQUFCWh0MAGgdDABwHQwAeB0MDDRBSWs1ePRIAThEOC7YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE3OKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA44MTcwI05ZTTI6NDU4M9oEAggB4AQB8ATAs4W9AYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdGZKfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AboKdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAf0qwXSBw0JLjEAFNoHBggAEAE6ZAcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=e3091e25c661ec46996688add07ba148bfe20dfd&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7756278961844469817&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:08 GMT
AN-X-Request-Uuid
bd50c3ed-b211-402b-a2fe-99325c3c3e1e
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
user_uploaded_lulo_clean_700_normal.ttf
s0.2mdn.net/sadbundle/14000621282275070897/fonts/ Frame 385F 		114 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://s0.2mdn.net/sadbundle/14000621282275070897/fonts/user_uploaded_lulo_clean_700_normal.ttf
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14000621282275070897/501ef24f75c19d412e4921509dd720dd.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:805::2006 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
12da6fafe2e21d807d0f688ef6804fd25cbf2ec7234aca6951fd24d141677aec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 11:52:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
373871
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
47817
x-xss-protection
0
last-modified
Wed, 28 Sep 2022 17:05:58 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 15 Jun 2024 11:52:58 GMT
css
fonts.googleapis.com/ Frame 385F 		2 KB
559 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Montserrat:400
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14000621282275070897/501ef24f75c19d412e4921509dd720dd.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d243481a66bdffbe09bc2f74f8f1b57714dcd20963e8703c1372716d3fe689a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 19:20:57 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:44:09 GMT
9a1b121ffd0310d1fa3507d0405af811.jpg
s0.2mdn.net/sadbundle/14000621282275070897/media/ Frame 385F 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/14000621282275070897/media/9a1b121ffd0310d1fa3507d0405af811.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:805::2006 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0ecf1caa8d2b7b759753f86062910edeb05d5465f35226fa489818107fe805db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 03:01:50 GMT
x-content-type-options
nosniff
age
405739
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13052
x-xss-protection
0
last-modified
Wed, 28 Sep 2022 17:05:58 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 15 Jun 2024 03:01:50 GMT
0ecf98e08e10306639c9fc79af98c934.jpg
s0.2mdn.net/sadbundle/14000621282275070897/media/ Frame 385F 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/14000621282275070897/media/0ecf98e08e10306639c9fc79af98c934.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:805::2006 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6e2d2c853e60809ca916eab7239037e6f86827eff837564ca5736a934ae69bbe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 15:15:35 GMT
x-content-type-options
nosniff
age
361714
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14997
x-xss-protection
0
last-modified
Wed, 28 Sep 2022 17:05:58 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 15 Jun 2024 15:15:35 GMT
0b1487280756b26a04d93719d143ccfb.jpg
s0.2mdn.net/sadbundle/14000621282275070897/media/ Frame 385F 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/14000621282275070897/media/0b1487280756b26a04d93719d143ccfb.jpg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:805::2006 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
852c97ef5719292c20ce99a105b210a526e92b1df5d7341002548ba7604e19d3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 01:16:41 GMT
x-content-type-options
nosniff
age
325648
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11702
x-xss-protection
0
last-modified
Wed, 28 Sep 2022 17:05:58 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 16 Jun 2024 01:16:41 GMT
3f84f235c5dfb914dddece45b9276002.svg
s0.2mdn.net/sadbundle/14000621282275070897/media/ Frame 385F 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/sadbundle/14000621282275070897/media/3f84f235c5dfb914dddece45b9276002.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:805::2006 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9c5294b56577e7ddc7459384d98960e73d9c6c5cd38e46d4162660d5dcfb23d9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://s0.2mdn.net/sadbundle/14000621282275070897/index.html?ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 15 Jun 2023 19:43:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
432048
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1763
x-xss-protection
0
last-modified
Wed, 28 Sep 2022 17:05:58 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 14 Jun 2024 19:43:21 GMT
visit.js
tps.doubleverify.com/ Frame D4EB 		724 B
752 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=286&ttfrms=63&brid=3&brver=114.0.5735.133&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=2151&ddur=127&uid=1687290249069909&jsCallback=dvCallback_1687290249069280&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&dvp_isOnHead=1&jsver=3941&tgjsver=3941&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dytduubyrq%26e%3D1069342552190&fcifrms=25&brh=2&sdf=2&dvp_epl=196&noc=4&nav_pltfrm=Win32&ctx=13693614&cmp=29652998&sid=7119312&plc=363876445&crt=193266029&btreg=554230373&btadsrv=doubleclick&adsrv=1&advid=10627282&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=192802471.539249&dvp_tukv=137636.5076520578&dvp_strhd=0.5&dvpx_strhd=0.5&dvp_tuid=1343740250470&jurtd=3067438614
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
5f78f98a558d27197934b2f0a131bf9ce129d1cc2af4e7c7dc0dc7f0670fea29

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:09 GMT
Content-Encoding
br
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0
Connection
keep-alive
Timing-Allow-Origin
*
Expires
06/19/2023 19:44:09
container.html
7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 146F 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:08 GMT
expires
Wed, 19 Jun 2024 19:44:08 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 8DE5 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:09 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:09 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 0283 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 14:56:57 GMT
content-encoding
br
x-content-type-options
nosniff
age
362832
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 15 Jun 2024 14:56:57 GMT
async_usersync
ib.adnxs.com/ Frame A93C 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:09 GMT
AN-X-Request-Uuid
647a6c02-0b83-43f3-b4b4-005db7bc9e7a
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F42A 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
46538
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 06:48:31 GMT
expires
Wed, 19 Jun 2024 06:48:31 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 756C 		783 B
535 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
2a30e8fbc9d0c48c41d2e345100ff5981a1ce634740ba0de1e0ceacd913d604b
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-tEy7mqd2jRqS9NJ-621GMQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
513
content-security-policy
script-src 'report-sample' 'nonce-tEy7mqd2jRqS9NJ-621GMQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:09 GMT
expires
Tue, 20 Jun 2023 19:44:09 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame AA36 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 14:56:57 GMT
content-encoding
br
x-content-type-options
nosniff
age
362832
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 15 Jun 2024 14:56:57 GMT
JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2
fonts.gstatic.com/s/montserrat/v25/ Frame 385F 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v25/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:804::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://s0.2mdn.net
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 02:30:15 GMT
x-content-type-options
nosniff
age
407634
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12708
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 18:55:59 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 15 Jun 2024 02:30:15 GMT
5111
8proof.com/app/rtbmarkup/ Frame 367C 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://8proof.com/app/rtbmarkup/5111?id=515456897218&ctd=110096&crid=1178&ap=ZJIBiAAKoMUKcQhIAAXjoCOFh5lBP83h-39-qg
Requested by
Host: 7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
URL: https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.116.53.150 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
96.35.7434.ip4.static.sl-reverse.com
Software
nginx /
Resource Hash
d975ebce186e1c0c67b2c148153140b918f8d505b8d0034c0832c20cb79308fe

Request headers

Referer
https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html;charset=utf-8
date
Tue, 20 Jun 2023 19:44:09 GMT
server
nginx
vary
Accept-Encoding
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230615/r20110914/client/ Frame 146F 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230615/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: 7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
URL: https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
30dd4d046ee0a560951014c2c3f71fb0b620af27279bd7c5ff8b4ac877214291
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 16:08:20 GMT
content-encoding
br
x-content-type-options
nosniff
age
12949
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8121
x-xss-protection
0
server
cafe
etag
8940155340736220798
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 16:08:20 GMT
l
www.google.com/ads/measurement/ Frame 146F 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaR2PbVzeW278t69h-k9XZZE_sGXCZLA0zJFHpv1xBE-76wl2GyMGOIkI_iMMMQhKDidxHSyU2U7g5BsQEPqKU8V9yLrNg
Requested by
Host: 7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
URL: https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 146F 		24 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: 7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
URL: https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 05:52:03 GMT
content-encoding
br
x-content-type-options
nosniff
age
49926
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 19 Jun 2024 05:52:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 146F 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
URL: https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:09 GMT
delete
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=b703beb6a13d3dbad7335e1ae9a1af96&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:09 GMT
X-Powered-By
ASP.NET
delete
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/ 		0
805 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=b703beb6a13d3dbad7335e1ae9a1af96&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Requested by
Host: cdn.czx5eyk0exbhwp43ya.biz
URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

source-system
Plugin
site-code
DFM
autoqa
false
accept-language
en-CA,en;q=0.9
settingskey
BANG,MERC
authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NTkyOTAyNDF9.1xGzPkvMByCpbBPhHX6yqb4MapCEBEieVmzCkvdK1EY
ssid
4e8ccc76dcfe04e8ba674086dff8eba3
environment
prod
config-code
BANGWPPRODWAB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
application/json
access-control-allow-origin
*
accept
application/json
attr
MERC
location
System
Referer
https://www.mercurynews.com/
version
Version: 2.8.5

Response headers

Expires
-1
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:09 GMT
X-Server-Time
6/20/2023 7:44:10 PM
Server
Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Content-Length
0
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
SPug
simage4.pubmatic.com/AdServer/ Frame AD44 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:09 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
view
googleads4.g.doubleclick.net/pcs/ Frame 8832 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstYbk309DJ6DEKvd_TYbfpA1ShLX9GMDojrkNQhxkbWw0P7ND6HG2oZnqiMnZ9hnviUqYRZOYYdIvNQEadrRAfUHq5lOrrgAuE1o0JPMmT0Plfd3yZfhMy8ki07cjh8DjFu88WQiNkcLvEsiqfZNCM_klKvsQOQVcMOKAXoFS4a&sai=AMfl-YRfr9unreniGWboZtODvuCG5Qjultuwx0kPxA046bL3PGCCop1QAJQFt9gJfRGs8SMOl0ma7g8C1t64FjpMNkQ6Ak2LbxBsWvw-Bw&sig=Cg0ArKJSzObzUKvVlw1oEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1922&vt=11&dtpt=1527&dett=3&cstd=391&cisv=r20230615.66429&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.13.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
yul02s04-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:10 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:10 GMT
montserrat-v25-latin-800.woff2
cdn.8proof.com/ads/assets/fonts/ Frame 367C 		0
0
montserrat-v25-latin-600.woff2
cdn.8proof.com/ads/assets/fonts/ Frame 367C 		0
0
activeview
pagead2.googlesyndication.com/pcs/ Frame D3CD 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvxlJZhwjd7tOuPIvLm7SADcWMT6wAjlJWeTgnlyaUGnbJX-1K58XZ-PyHqc_JfX31hRgg1cY9ZBgidCKp2ZEClTiWf_S1EnmA&sig=Cg0ArKJSzDtkMawWjJUHEAE&id=lidar2&mcvt=1516&p=0,0,250,300&mtos=1516,1516,1516,1516,1516&tos=1516,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=1241189742&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687290245954&rpt=2594&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame FE91 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLUCvQXAVQFAAADANYABQEIhoPIpAYQ6bT3kquu7tlgGKGWrf2BkMCvECo2Cc4aUG9TBZw_ET1YP1gDKpU_GQAAAIDC9fA_IWVyeZLFFKE_KVq77UJznaY_MQAAACCF67E_MO7fwQ04mFBAmDlIAlDW563TAVi5q5cBYABopq60AXjcpAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNjAzODY4OCwgMCk7dWYoJ2knLCA3MzYxODkwLCAwKTt1ZignZycsIDE4Mjk2ODA0LCAwKTt1ZigncycsIDI3NTYxOTAwMCwgMCk7dWYoJ3InLCA0NDMyNDk2MjIFVfCLkgKhBCF5bTRxVHdqUXVMQVpFTmJucmRNQkdBQWd1YXVYQVRBQ09BQkFBRWlZT1ZEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRcW9BUXF3QVFDNUFTT3htZWZzbktZX3dRRWpzWm5uN0p5bVA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUhpcXNFRDlRRzhYYk05bUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DSXl5dmlJUUN4Z0NMUUFBQUFDNkF3bE9XVTB5T2pZME16VGdBLWxEZ0FUZl80NExpQVRBOE5rSWtBUUJtQVFCd1EFNQkBCE1rRQkJAQEYRFlCQUR4QgELDQF4aUFXaU1wZ0Z1TG0yZ3dHcEJkT2tGSFI3U2UwX3NRVQUmHDB3emxQOEVGBQ0cTk1NMVRfSkIBYxxPQzFDdEVfMA0oBQEETmsJKCko8EBnQmNFaThBWGszOXdJLUFXZ3lmQUNnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkFrQQFIBQEAQh3HBEJrBRMFAQBDHRhETGdHQ2cuLpoCmQEhdlJiMnRBOiUCZExtcmx3RWdBQ2dBTWR2NWZtcThkTzhfT2dsPV0UUkE2VU5KBV0FxQQ5UgEICQEEQloJCAEBBEJoAQYJAQRCcAkIAQEEQngBBgkBEEI0QUlrNXD0SAE4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xNzioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjY0MzTaBAIIAeAEAfAE1uet0wGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWiiQf6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGqSXaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgH3KQF0gcNCS4xABTaBwYIABABOmQHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=e4003be7b5217fed355d63f0ea4c6ccb9bf45467&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7756278961844469817&vd=ct~0|rr~6&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&cid=3&cr=pv&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:10 GMT
AN-X-Request-Uuid
51ed447e-1ce3-44dd-9c66-c9c737e9549d
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.html
eus.rubiconproject.com/ Frame B9B4 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:10 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame AC62 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:10 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:12 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 2D0A 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6813f7edd4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:10 GMT
server
cloudflare
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 415C 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165944
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:10 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 6EC3
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
43 B
511 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:09 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
299
/
rtb-csync.smartadserver.com/redir/ Frame 6EC3
Redirect Chain
  • https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%2...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=2900c0d7-4774-4a53-9832-f8fba665f58e
43 B
512 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=2900c0d7-4774-4a53-9832-f8fba665f58e
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

date
Tue, 20 Jun 2023 19:44:10 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=2900c0d7-4774-4a53-9832-f8fba665f58e
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
/
rtb-csync.smartadserver.com/redir/ Frame 6EC3
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc...
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
43 B
553 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
v1
match.sharethrough.com/sync/ Frame 6EC3
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4614819635623485669&gdpr=0&gdpr_consent=
68 B
607 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4614819635623485669&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
3.223.221.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-221-83.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:10 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

location
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4614819635623485669&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
e09bad714a425a93d6dea503dcf9c528.gif
cs.admanmedia.com/ Frame 6EC3 		0
199 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.admanmedia.com/e09bad714a425a93d6dea503dcf9c528.gif?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D130%26partneruserid%3D%5BUID%5D%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BGDPR_CONSENT%5D&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
80.77.87.161 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:10 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
Server
nginx
Connection
keep-alive
X-Frame-Options
DENY
vevent
nym1-ib.adnxs.com/ Frame D3CD 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQiGg8ikBhDwhKWi4f7ggBAYoZat_YGQwK8QKjYJEUn0Morldj8RBA63L997cT8ZAAAAgML18D8hBA63L997cT8pEkkJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlDspYrNAVi5q5cBYABopq60AXjEtgWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFjByJywgNDMwMDg0ODQ0BRbwsJIC-QUhTkoyUnV3amdoLUlhRU95bGlzMEJHQUFndWF1WEFUQUJPQUJBQUVqMVpGRHUzOEVOV0FCZ2dRWm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUUtvQVFLd0FRQzVBWUZvNURDdE4zNF93UUh3S2kxQVFlRjJQOGtCQUFBQUFNSlQ3al9aQVRZOHZWS1dJZlVfNEFIMHF2b0Q5UUhfOXY4LW1BSUFvQUlDdFFJQQEzCHZRSQEH2EF3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01PQ05TYmh5c1FBaGdDTFEBO_BVQ2lBeGNJc29uQUxCQUdHQUV0aXVpNU56SUhaR1ZtWVhWc2RLSURGZ2p1dXNBc0VBb1lBUzBRbm5JX01nWjFibWx4ZFdXaUF3NEkxSnVIS3hBTEdBSXQBWmRBTG9EQ1U1WlRUSTZORFk1TS1BRDZVUHBBdwUeBQFAOEFQZkU0QUVtNG5uQ29nRW4BCLhwQUVBWmdFQkxJRUNnamt3cGtORUtDenRBMjZCQm9JbmdrUktWeVB3dlVvekQ4WgVJCQEgZzVNS1pEY0VFGSAIX0pCCRwFARgyQVFEOFFRBQwFAfBSSUlGSHdpaHl5VVFCUmdCSWdORFFVUXBOank5VXBZaDlUOHhRbURsMENMYnlULUlCZFVra0FYQzlrNllCWmZhNG9jQnFRWFRwQlIwZTBudFA3RUYFWAUBCERCQh1rPHlRVUFBQUNnWXR6U1A5RUYFIwUBBERaFSi4UEFfNEFXdkJQQUYxcGlIQ3ZnRnJQM1FBb0lHQTBOQlJJZ0dCSkFHQVpnR0FLRUcFPwUBJENvQmdTeUJpUUoFDwkBAFIJBwUBAFoFBgkBAGgJBwEBPEM0QmdvLpoCxQEhR0NOcC0-_QIsTG1ybHdFZ0FDZ0FNHc1MT2dsT1dVMHlPalEyT1ROQTZVTko5NQQ5UgFbCQEAQh15BEJoOZkEOXAJIAEBBEJ4AQYJARRCNEFJSUKqlQEESkERmPSbAVBBX9gCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTc4qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDzEyOTE3I05ZTTI6NDY5M9oEAggB4AQB8ATspYrNAYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjY0NTS4BgDBBgAAAAAAAPA_0AaeqwLaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gaHAQjC9k4SgAFLaFNBVlZvQUFBQURBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnQVFMQzB1Z2RJdjdXNkIxRHBRMWkyTW5FQUFBQUFBQUFBQUhnQWdRRUFBQUEp3VRJZ0JBSkFCQUpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAfEtgXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=b9b666f959af09bb83a91667e17f0723f5b901aa&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7756278961844469817&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:10 GMT
AN-X-Request-Uuid
5d125ad4-a668-425d-8a33-f34219f3ebf0
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1249931897&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=MeterStart&el=%7B%22ConversationName%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ConversationDateStarted%22%3A%22Not%20Set%22%2C%22ConversationDateEnded%22%3A%22Not%20Set%22%2C%22ConversationDateExpiratation%22%3A%22Not%20Set%22%2C%22ConversationPaywallLimit%22%3A%22Not%20Set%22%2C%22ArticleViews%22%3A%22Not%20Set%22%7D&_u=aGDACEAjBAAAACgFKAC~&jid=&gjid=&cid=690102992.1687290241&tid=UA-61435456-5&_gid=1597915438.1687290241&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=Not%20Set&cd96=Not%20Set&cd97=Not%20Set&cd98=Not%20Set&cd100=1687290250308.yi80b1uu&cd101=b703beb6a13d3dbad7335e1ae9a1af96&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=Not%20Set&cd108=Not%20Set&cd109=Not%20Set&cd110=Not%20Set&cd111=Not%20Set&cd112=Not%20Set&cd113=Not%20Set&cd114=Not%20Set&cd115=Not%20Set&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=713318159
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 06:52:09 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
46321
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
css
fonts.googleapis.com/ 		8 KB
745 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,300&G2I_ActionId=120521&returnUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%3FclearUserState%3Dtrue
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200a Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
124f165a1243b48bd2ac21cebd8852c818c5deb7692fbfb5c80f5d5b72625da9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:10 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 19:42:44 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:44:10 GMT
truncated
/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cd0b7385c8a691d9b2e7af11f3fbe1e7b1f42ecf11531882594908bf4a1b830e

Request headers

Referer
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
application/x-font-woff2;charset=utf-8
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1249931897&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=ActionShown&el=%7B%22ConversationName%22%3A%22BANG%20Klay%20Production%20Conv%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ActionName%22%3A%22a-toaster-sub-pv1-mg2pw05-flash%22%2C%22ActionType%22%3A%22Banner%22%7D&_u=aGDACEAjBAAAACgFKAC~&jid=&gjid=&cid=690102992.1687290241&tid=UA-61435456-5&_gid=1597915438.1687290241&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=Not%20Set&cd96=Not%20Set&cd97=Not%20Set&cd98=Not%20Set&cd100=1687290250463.dzxn57wf&cd101=b703beb6a13d3dbad7335e1ae9a1af96&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=BANG%20Klay%20Production%20Conv&cd108=1&cd109=1&cd110=2&cd111=2023-06-20T19%3A44%3A09Z&cd112=Not%20Set&cd113=2023-08-19T19%3A44%3A09Z&cd114=a-toaster-sub-pv1-mg2pw05-flash&cd115=Banner&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=1283364215
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 06:52:09 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
46321
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pv&page=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&metered=1%7C2&metername=BANG%20Klay%20Production%20Conv&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=956e0444-ad43-439d-b5cc-d3b22d4faf9c&pid=45fbb049-cd4d-4548-b342-1bd2d9960567&dtm=1687290250525&qnm=_matherq&visible=1&tabid=d1035f59-8a38-44c6-83f8-8befa73f770a&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x8818&tofa=1687290242&vid=1&lvidt=1687290242&duid=ba10b823-5015-4d9c-bc8f-648a9ff50d11&fp=967226427&cid=ma23578&mrk=239876506&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJkaXNwbGF5IiwiYWN0aW9uIjoiYmFubmVyIiwiZGF0YSI6eyJtZXRlciI6eyJpZCI6IjIiLCJuYW1lIjoiTWV0ZXJlZCIsIm1ldGhvZCI6IkRlZmF1bHQifSwiY2FtcGFpZ24iOnsiaWQiOiIxMDE0MTgiLCJuYW1lIjoiQkFORyB3b3JkIHByZXNzIHcvYWRibG9jayJ9LCJjb252ZXJzYXRpb24iOnsibmFtZSI6IkJBTkcgS2xheSBQcm9kdWN0aW9uIENvbnYiLCJvcmRlciI6IjIifSwiYWN0aW9uIjp7Im5hbWUiOiJhLXRvYXN0ZXItc3ViLXB2MS1tZzJwdzA1LWZsYXNoIiwidHlwZUlkIjoiMSIsInR5cGVOYW1lIjoiYmFubmVyIiwib3JkZXIiOiIyIn19LCJ2ZW5kb3IiOiJtZzIiLCJ0eXBlIjoidW5rbm93biJ9LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjY5MDEwMjk5MiIsInJlZlRpbWUiOiIxNjg3MjkwMjUwNTIyIn0seyJ0eXBlIjoibWcyIiwiaWQiOiJiNzAzYmViNmExM2QzZGJhZDczMzVlMWFlOWExYWY5NiIsInJlZlRpbWUiOiIxNjg3MjkwMjUwNTAxIn1dLCJhdWRpZW5jZSI6W3sicHJvdmlkZXIiOiJ1c2VyREIiLCJzZWdtZW50cyI6WyJNQVRIRVJfVTlfSU5TVEFOVEJfMjAyMDAyMDMiXSwicGFnZUlkIjoiNDVmYmIwNDktY2Q0ZC00NTQ4LWIzNDItMWJkMmQ5OTYwNTY3In0seyJwcm92aWRlciI6ImlTZWdzIiwic2VnbWVudHMiOlsiTUFUSEVSX1U5X0lOU1RBTlRCXzIwMjAwMjAzIl0sInBhZ2VJZCI6IjQ1ZmJiMDQ5LWNkNGQtNDU0OC1iMzQyLTFiZDJkOTk2MDU2NyJ9XSwibWcyRGF0YSI6eyJ2ZXJzaW9uIjoiVmVyc2lvbjogMi44LjUiLCJlbnZpcm9ubWVudCI6InByb2QiLCJhdXRoU3lzdGVtIjoiQXV0aDBVbml2ZXJzYWxMb2dpbiIsImNhbXBhaWduTmFtZSI6IkJBTkcgd29yZCBwcmVzcyB3L2FkYmxvY2siLCJjYW1wYWlnbklkIjoiMTAxNDE4Iiwic3Vic2NyaXB0aW9ucyI6W10sImNvbnZlcnNhdGlvbiI6eyJJZCI6IjEwNDAwMCIsIkNvZGUiOiIxMDQwMDAiLCJOYW1lIjoiQkFORyBLbGF5IFByb2R1Y3Rpb24gQ29udiIsIk9yZGVyIjoiMiIsIlByb3BlcnRpZXMiOnsiUGF5d2FsbExpbWl0IjoiMiIsIlZpZXdzIjoiMSIsIkRhdGUiOnsiRXhwaXJhdGlvbiI6IjIwMjMtMDgtMTlUMTk6NDQ6MDkuODM0WiIsIlN0YXJ0ZWQiOiIyMDIzLTA2LTIwVDE5OjQ0OjA5LjgzNFoifSwiQXJ0aWNsZUxlZnQiOiIxIiwiVmlld1R5cGUiOiJDb252ZXJzYXRpb24iLCJQYXl3YWxsSW5mbyI6eyJBcnRpY2xlTGVmdCI6eyJDb252ZXJzYXRpb24iOiIxIiwiTWV0ZXIiOiJ1bmxpbWl0ZWQifSwiTGltaXQiOnsiQ29udmVyc2F0aW9uIjoiMiIsIk1ldGVyIjoidW5saW1pdGVkIn0sIk1pblZpZXciOiJDb252ZXJzYXRpb24ifX19fSwidXNlckRhdGEiOnsibWcyRGF0YSI6eyJPd25lZFN1YnNjcmlwdGlvbnMiOltdLCJBdXRoU3lzdGVtIjoiQXV0aDBVbml2ZXJzYWxMb2dpbiIsIkRpZ2l0YWxBY2Nlc3MiOnsiQWNjZXNzTGV2ZWwiOnt9LCJTdWJzY3JpcHRpb24iOltdfSwiSWdtUmVnSUQiOm51bGwsIkVtYWlsIjoiIiwiTnp3TGlkIjpudWxsLCJNYXN0ZXJJZCI6bnVsbCwiRGlzcGxheU5hbWUiOiIiLCJFbWFpbFByZWZlcmVuY2VzIjpudWxsLCJBZGREYXRlIjpudWxsfX19
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:10 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1249931897&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=SetTimer&_u=aGDACEAjBAAAACgFKAC~&jid=&gjid=&cid=690102992.1687290241&tid=UA-61435456-5&_gid=1597915438.1687290241&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=11214&cd96=6996&cd97=Not%20Set&cd98=Not%20Set&cd100=1687290250587.aos4nna&cd101=b703beb6a13d3dbad7335e1ae9a1af96&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=BANG%20Klay%20Production%20Conv&cd108=1&cd109=1&cd110=2&cd111=2023-06-20T19%3A44%3A09Z&cd112=Not%20Set&cd113=2023-08-19T19%3A44%3A09Z&cd114=Timer&cd115=Banner&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=1652633627
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 06:52:09 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
46321
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1249931897&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=PageView&el=%7B%22Page%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify%22%2C%22ContentType%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Metered%22%7D&_u=aGDACEAjBAAAACgFKAC~&jid=&gjid=&cid=690102992.1687290241&tid=UA-61435456-5&_gid=1597915438.1687290241&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=11214&cd96=6996&cd97=Not%20Set&cd98=Not%20Set&cd100=1687290250605.145u9wr&cd101=b703beb6a13d3dbad7335e1ae9a1af96&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=BANG%20Klay%20Production%20Conv&cd108=1&cd109=1&cd110=2&cd111=2023-06-20T19%3A44%3A09Z&cd112=Not%20Set&cd113=2023-08-19T19%3A44%3A09Z&cd114=Timer&cd115=Banner&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=1372939990
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 06:52:09 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
46321
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 756C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306150101&jk=2881518130063934&rc=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
usync.js
eus.rubiconproject.com/ Frame B9B4 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:10 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 03:39:20 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=28510
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 03:39:20 GMT
usync.html
eus.rubiconproject.com/ Frame 1FF0 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:10 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
/
csync.smilewanted.com/ Frame BD08 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68143eceb4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:10 GMT
server
cloudflare
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 0451 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:10 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:12 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 8192 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165944
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:10 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
dcm
aax-eu.amazon-adsystem.com/s/ Frame 8D4D
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Faax-eu.amazon-adsystem.com%2Fs%2Fdcm%3Fpid%3Df7a5db36-1d5c-4c26-81b6-b4d0807faffb%26id%3D...
  • https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=4614819635623485669&gdpr=0&gdpr_consent=
43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=4614819635623485669&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
67.220.228.202 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:11 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
CCTMXPHS862DT50VWF2P
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://aax-eu.amazon-adsystem.com/s/dcm?pid=f7a5db36-1d5c-4c26-81b6-b4d0807faffb&id=4614819635623485669&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
rtb-csync.smartadserver.com/redir/ Frame 8D4D
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
  • https://rtb.adstanding.com/ssp/bidswitch/cookie?bidswitch_ssp_id=smartadserver&bidswitch_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://x.bidswitch.net/sync?dsp_id=317&user_id=4cb975a7186b097f02ae275c059e0902&expires=30&ssp=smartadserver&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=
43 B
711 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location
//rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=
Date
Tue, 20 Jun 2023 19:44:11 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
/
rtb-csync.smartadserver.com/redir/ Frame 8D4D
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?&rd=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D91%26partneruserid%3D%23PM_USER_ID%26gdpr%3DPM_GDPR%26gdpr_conse...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
43 B
593 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
date
Tue, 20 Jun 2023 19:44:10 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
/
rtb-csync.smartadserver.com/redir/ Frame 8D4D
Redirect Chain
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partnerus...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=d32ed1d1d06612715aa282670b9dccf4&gdpr=0&gdpr_consent=0
43 B
630 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=d32ed1d1d06612715aa282670b9dccf4&gdpr=0&gdpr_consent=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
x-content-type-options
nosniff
server
ayl-lb-usa02
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=d32ed1d1d06612715aa282670b9dccf4&gdpr=0&gdpr_consent=0
p3p
CP="CAO PSA OUR"
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
2
content-length
0
expires
0
/
rtb-csync.smartadserver.com/redir/ Frame 8D4D
Redirect Chain
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=XFx9J1pZfCRHCXRzDw1pcF0NISJHDidzXQ5V9vm3
43 B
597 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=XFx9J1pZfCRHCXRzDw1pcF0NISJHDidzXQ5V9vm3
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=XFx9J1pZfCRHCXRzDw1pcF0NISJHDidzXQ5V9vm3
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame 8832 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKeCvBMHgUAAAMA1gAFAQiGg8ikBhCr-JbT1NXbjgUYoZat_YGQwK8QKjYJMPoK0oxFkz8RIA-H6Z4cjT8ZAAAAgML18D8hIA-H6Z4cjT8pL_oJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlDAs4W9AVi5q5cBYABopq60AXj0qwWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgNjc5NjIzOSwgMCk7dWYoJ2knLCA3ODcwNzg2LCAwKTt1ZignZycsIDE5ODQ5NDc5LCANKfCfcicsIDM5NjQ1MDI0MCwgMCk7kgKBBCFWbVczZWdpVC1wTWFFTUN6aGIwQkdBQWd1YXVYQVRBQU9BQkFBRWpxUDFEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRR29BUUd3QVFDNUFmbEZiSjVhUlpNX3dRSDVSV3llV2tXVFA4a0JBQUFBQUFBQThEX1pBUUFBQQEPdFBBXzRBSENzdUFEOVFITnpNdzltQUlBb0FJQnRRSQEiBEF2DQjwVXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQnVnTUpUbGxOTWpvME5UZ3o0QVBwUTRBRXhvN3RDWWdFekk3dENaQUVBWmdFQWNFRUFBBWMUQUFBREpCAQcNARgyQVFBOFFRDQ5gQUFBSWdGNXlPcEJkT2tGSFI3U2UwX3NRVQEaCQEYTUVGbXBtWgECEHVUX0pCATscSUN3RnNnXzAuKAAITmtGCTEAQSEIsGdCZG9POEFXSHdyc0otQVhQNTU0RGdnWURWVk5FaUFZQWtBWUJtQVlBb1FhYQFcPG1abTVQNmdHQkxJR0pBa0EVAQBCHcsEQmsVFwRBQx0YRExnR0NnLi6aApkBIWxoVUVSdzoFAjRMbXJsd0VnQUNnQU1acQFtYFptYmtfT2dsT1dVMHlPalExT0ROQTZVTkoRYgw4RDlSEQwMQUFCWh0MAGgdDABwHQwAeB0MDDRBSWs1ePRIAThEOC7YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE3OKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA44MTcwI05ZTTI6NDU4M9oEAggB4AQB8ATAs4W9AYgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdGZKfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AboKdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAf0qwXSBw0JLjEAFNoHBggAEAE6ZAcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=e3091e25c661ec46996688add07ba148bfe20dfd&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7756278961844469817&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:10 GMT
AN-X-Request-Uuid
619b8edf-5d34-4285-8db9-98bf4011c86d
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 8832 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsunIbwbxnkRDzxPTTssYWAC6RqSQXyFNpNcxmvPVgDmevhiAw46Bxb-QCWX8aZVPyylJk7nYojZaxYQ2DBvRwgdO_chil9a&sig=Cg0ArKJSzHPJzTLRi4kBEAE&id=lidar2&mcvt=1697&p=0,0,250,300&mtos=1697,1697,1697,1697,1697&tos=1697,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=34&adk=730607261&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687290245999&rpt=3181&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
884504ed-5b09-4e94-a01d-cb1d373ee4d9
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/884504ed-5b09-4e94-a01d-cb1d373ee4d9
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
/
csync.smilewanted.com/ Frame 274F 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68144fe194400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:11 GMT
server
cloudflare
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 2284 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:11 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 0CBF 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:11 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:13 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 7F5E 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165943
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:11 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame F8A7
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
  • https://dsp.nrich.ai/bidswitch/sync?bidswitch_ssp_id=smartadserver&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
  • https://x.bidswitch.net/sync?dsp_id=283&user_id=cf778d1d-d203-4e00-b50f-6457d4a0869b&expires=1&user_group=2&ssp=smartadserver&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=&gdp...
  • https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=
43 B
711 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location
//rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=
Date
Tue, 20 Jun 2023 19:44:11 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
/
rtb-csync.smartadserver.com/redir/ Frame F8A7
Redirect Chain
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partnerus...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=d32ed1d1d06612715aa282670b9dccf4&gdpr=0&gdpr_consent=0
43 B
630 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=d32ed1d1d06612715aa282670b9dccf4&gdpr=0&gdpr_consent=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
x-content-type-options
nosniff
server
ayl-lb-usa02
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=d32ed1d1d06612715aa282670b9dccf4&gdpr=0&gdpr_consent=0
p3p
CP="CAO PSA OUR"
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
17
content-length
0
expires
0
/
rtb-csync.smartadserver.com/redir/ Frame F8A7
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc...
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
43 B
671 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:10 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame F8A7
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=35620282-96f1-466f-b370-6daf818c9a83&gdpr=0
43 B
671 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=35620282-96f1-466f-b370-6daf818c9a83&gdpr=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=35620282-96f1-466f-b370-6daf818c9a83&gdpr=0
date
Tue, 20 Jun 2023 19:44:11 GMT
content-length
0
redir
rtb-csync.smartadserver.com/ Frame F8A7
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
43 B
630 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
Date
Tue, 20 Jun 2023 19:44:11 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
truncated
/ Frame 146F 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0b3f7c88870faac2e6dad62d6c766326944e9bb06bdcabecf5da85b150f4373a

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
ca
choices.trustarc.com/ Frame 8832 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=672780485&js=pmw1&base=te-clr1-71eb21d3-78e3-444e-bb1c-f2054738ed31
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=672780485&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
37cbd4d5cd54d815abbd679083f0a6665a14eddf560765e8ef872c9125057847
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P1
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2332
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
y6I4XqpQQ5aWECWThpG-9Yqpf6LvcIrzSAzip-FLwHUjZgnmGktKrw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 8832 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=672780485&js=pmw2
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=672780485&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P1
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
kzN62CqPA88D85NJJlJ9RZ-UrRftHDCm30IUzGSFr43qvujoYxIWGw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame 8832 		43 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=3d8e
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P1
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
6C-vc42-qMdcPiLTcAVu67qPCeRGQ8M9hXOIOe6-M5w7kUhqU77xQQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 8832 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=28666691&js=st_1&sz=300x250&c=te-1d53
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=28666691&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
350246718a36866e0ea74a03baf6e2560a7d880a7d0d4aff4f460aa2fea74a51
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P1
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2245
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
mMWWNE2kKIPp6nKUJ27EjvFcRbS6B4ALpiLnyYHU2-LGtLDhrnEfxw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 8832 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=28666691&js=st_2
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=28666691&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P1
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
K1M_84Ye3VEkhxZ0XMbv9bfMUGjuUxtICKZEk_3YrzcCfummelUxCg==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame 8832 		43 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=sojern02&pid=sojern01&cid=28666691&w=300&h=250&c=54da
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P1
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
sLvglwIxr3u1zbgYCNQApyNWI0ETQnGnuMs_NMniFMFRVyGL9obK-g==
expires
Mon, 26 Jul 1997 05:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame 1FF0 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:11 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 03:39:20 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=28509
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 03:39:20 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame F42A 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 14:56:57 GMT
content-encoding
br
x-content-type-options
nosniff
age
362834
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 15 Jun 2024 14:56:57 GMT
usync.js
eus.rubiconproject.com/ Frame 2284 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:11 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 03:39:20 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=28509
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 03:39:20 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 2D0A 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152216
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da68146f8594400-EWR
expires
Thu, 31 Dec 2037 23:55:55 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame 415C 		4 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=97701235&p=156383&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
c9940eea00a0c63e08ca41c46f1daecad74017966c12b61932472375efd064e6

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 07:30:23 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
adview
securepubads.g.doubleclick.net/pagead/ Frame 146F 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CvEkJiAGSZMXBKsiQxAOgx5fgCtqYiYdrz6mm744OwI23ARABIABg_eiigfADggEXY2EtcHViLTIxMjg3NTcxNjc4MTI2NjPIAQngAgCoAwGqBPECT9CWw6edDyAfMC1u6YssBnz3K-pTDE4rzNsRthY_WnNKeQ-YrDqMNUCYdIbDUGwvU0leBbds9ZRARVlxmP00eHke5oWpw4LbCcszlVexKTIZRu4KLlAIkQTt1CQp-_HgIGq-CVXmZPXug3FYMOWLUgQMqJrfmZ_4QTa1ew4Rf8shCtm4x1H3kA5Jr3DSANYirYFrrFms_aIYa9L9XEtrpSHgaaPp6KRV9_oxUKzHfMORVtIcA4hU28n25zhfJzMzsniZrTm7TUbiIgac779lhiakcJ7llTn61pMJlcmZ1KGYByHas1xsTGKlnSoYKVIlQafFh23dbtFL4B5qWyooPbsWVUjB24l4IgMzXHg34qBO301xvoWp1Uyf74hPT1yQ_LyyfgXI0d2FQi1RReqSZvy-RAXbI4sUW7Nc2RtNbkK2Cs8GRdtA3TXwUBJlsNfX1-86T1R_U7ulxOG1aEvg02cLYFVNc1AtqNbc1VjC2cOF4AQBgAbz-t6ksu6U5fIBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDQiAYRABMgKKAjoCgECACgP6CwIIAYAMAdAVAYAXAbIXHAoaEhRwdWItMjEyODc1NzE2NzgxMjY2Mxjc7Wo&sigh=zy_t3CkRg8U&uach_m=[UACH]&cid=CAQSOwBygQiDf8im4XU92gE1rTs_6DB2RV0VWxl48VhrXryaTdWozlbFubScs3L9b6ZbxheSWhG7rxrz1-qiGAE&cbvp=2&vis=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
win
8proof.com/app/ Frame 146F 		0
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://8proof.com/app/win?id=515456897218&ap=ZJIBiAAKoMUKcQhIAAXjoCOFh5lBP83h-39-qg&t=b&cbvp=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.116.53.150 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
96.35.7434.ip4.static.sl-reverse.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
content-length
0
server
nginx
async_usersync.html
acdn.adnxs.com/dmp/ Frame 8B37 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:11 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:13 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame 1CC2 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKdDfBMnQYAAAMA1gAFAQiGg8ikBhC4js7X6Z24uA4YoZat_YGQwK8QKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlCH1L2uAVi5q5cBYABopq60AXjFxgWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaHVmKCdhJywgNDI1NDI5MCwgMCk7dWYoJ2kFFBg2MDgyMCwgDRQsZycsIDExNjI0MDIyFRUAYwEpGDA2MjAwMTcVFTByJywgMzY1OTE0NjMxBRbwi5ICvQQhZEcxU2Z3anhuNjhURUlmVXZhNEJHQUFndWF1WEFUQUVPQUJBQUVpUkNGRHUzOEVOV0FCZ2dRWm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUkNvQVFxd0FRQzVBVGVqeW1tVWxDY193UUUzbzhwcGxKUW5QOGtCQUFBQUFBQUEwRF9aQVFBCQ50UEFfNEFIVWg0UUM5UUZ2MDlvNW1BSUFvQUlCdFFJBSQAdg0I8JV3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01YQ0xLUndDd1FCaGdCTFVaUElEUXlCelkwTmpNek5ET2lBeE1Jd1lfQUxCQUtHQUV0QUFDQVBqSURkVzVydWdNSlRsbE5Nam8xTXpVMDRBUHBRNEFFNlpMa0E0Z0UwSlBrQTVBRUFaZ0VBY0VFQUEFoxRBQUFESkIBBw0BGDJBUUE4UVENDmBBQUFJZ0Y2aW1wQmRPa0ZIUjdTZTBfc1FVARoJATxNRUZBQUJBOFlOYVBUX0pCATscT0MtMGUwXzAuKAAITmtGCTHwQ0FBOERfZ0JSTHdCZGE4eFFYNEJkTFVnd0tDQmdOVlUwU0lCZ1NRQmdHWUJnQ2hCaC1GNjFHNEh2VV9xQVlFc2dZa0NREUoIQUFFAXANAQBHHQwASR0MNHVBWUuaApkBIUZ4VU1IPkECNExtcmx3RWdBQ2dBTVItFW1MT2dsT1dVMHlPalV6TlRSQTZVTkoNaBBBOEQ5UhEMDEFBQlodDABoHQwAcB0MAHgdDAw0QUlrNXTgOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL_ICEQoGQURWX0lEEgc0aXIc8gISCgZDUEcBFAAIcV4Y8gIKCgVDUAEUOAEw8gINCghBRFZfRlJFUREQHFJFTV9VU0VSBRAADAkgKENPREUSAPICMwoIAVEFD7gnTldVMVptTmhNell5TkdSbFpqTTBPRE01TURBd01EbGkuMWM4NDIz8gILCgdDUAk1HADyAhAKBUlPAYAEBzSJBgDyASEESU8VITgTCg9DVVNUT01fTU9ERUwBKxQA8gIaChYyFgAcTEVBRl9OQU0FmAgeCho2HQAIQVNUAT4QSUZJRUQBPhwNCghTUExJVAFN8JoBMIADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTc4qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjEwNDEjTllNMjo1MzU02gQCCAHgBAHwBIfUva4BiAUBmAUAoAX______wEFGAHABQDJBQAFARTwP9IFCQkFC3wAAADYBQHgBQHwBde3HvoFBAgAEACQBgCYBgC4BgDBBgEhMAAA8D_QBpgD2gYWChAJERkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAfFxgXSBw0JETMBMQjaBwYBaHAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=adbb459185429cc3e9681c6311cd9a291cb72323&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dxkarpqq%26e%3D1069342552190,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dxkarpqq%26e%3D1069342552190&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:11 GMT
AN-X-Request-Uuid
03c8bd63-4586-4389-bcc2-0e6a233793b3
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame 1CC2 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:44:11 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
456188
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12830-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687290251.477240,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 66350
it
nym1-ib.adnxs.com/ Frame 1CC2 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLvCvBMbwUAAAMA1gAFAQiGg8ikBhC4js7X6Z24uA4YoZat_YGQwK8QKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlCH1L2uAVi5q5cBYABopq60AXjFxgWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaHVmKCdhJywgNDI1NDI5MCwgMCk7dWYoJ2kFFBg2MDgyMCwgDRQsZycsIDExNjI0MDIyFRUAYwEpGDA2MjAwMTcVFTByJywgMzY1OTE0NjMxBRbwi5ICvQQhZEcxU2Z3anhuNjhURUlmVXZhNEJHQUFndWF1WEFUQUVPQUJBQUVpUkNGRHUzOEVOV0FCZ2dRWm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUkNvQVFxd0FRQzVBVGVqeW1tVWxDY193UUUzbzhwcGxKUW5QOGtCQUFBQUFBQUEwRF9aQVFBCQ50UEFfNEFIVWg0UUM5UUZ2MDlvNW1BSUFvQUlCdFFJBSQAdg0I8JV3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01YQ0xLUndDd1FCaGdCTFVaUElEUXlCelkwTmpNek5ET2lBeE1Jd1lfQUxCQUtHQUV0QUFDQVBqSURkVzVydWdNSlRsbE5Nam8xTXpVMDRBUHBRNEFFNlpMa0E0Z0UwSlBrQTVBRUFaZ0VBY0VFQUEFoxRBQUFESkIBBw0BGDJBUUE4UVENDmBBQUFJZ0Y2aW1wQmRPa0ZIUjdTZTBfc1FVARoJATxNRUZBQUJBOFlOYVBUX0pCATscT0MtMGUwXzAuKAAITmtGCTHwQ0FBOERfZ0JSTHdCZGE4eFFYNEJkTFVnd0tDQmdOVlUwU0lCZ1NRQmdHWUJnQ2hCaC1GNjFHNEh2VV9xQVlFc2dZa0NREUoIQUFFAXANAQBHHQwASR0MNHVBWUuaApkBIUZ4VU1IPkECNExtcmx3RWdBQ2dBTVItFW1MT2dsT1dVMHlPalV6TlRSQTZVTkoNaBBBOEQ5UhEMDEFBQlodDABoHQwAcB0MAHgdDAw0QUlrNXT0SAE4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xNzioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQOMTA0MSNOWU0yOjUzNTTaBAIIAeAEAfAEh9S9rgGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXXtx76BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGmAPaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgHxcYF0gcNCS4xABTaBwYIABABOmQHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=97ae985201d796a34b8890df8cc87bbedcaf6017
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:11 GMT
AN-X-Request-Uuid
13a55407-5042-46f1-8011-14f91597d707
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
da9e50ca-0afc-4f0c-b142-6cd260d6a90a.gif
crcdn01.adnxs-simple.com/creative/p/1041/2022/6/15/36843227/ Frame 1CC2 		46 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://crcdn01.adnxs-simple.com/creative/p/1041/2022/6/15/36843227/da9e50ca-0afc-4f0c-b142-6cd260d6a90a.gif
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.21.3 /
Resource Hash
2a7db475948607918756e70471860bd44d4c644bc18a22a2ff3ea249173cbb7a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:11 GMT
Last-Modified
Wed, 15 Jun 2022 20:25:35 GMT
Server
nginx/1.21.3
x-amz-request-id
db3de06c-e663-4205-852e-e97fa5088760
ETag
"261f40a68ebf8e5ef2104e40bb9c6586"
Content-Type
image/gif
Access-Control-Allow-Origin
*
X-Clv-Request-Id
db3de06c-e663-4205-852e-e97fa5088760
Cache-Control
max-age=3888000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
47391
X-Clv-S3-Version
2.5
Expires
Fri, 04 Aug 2023 19:44:11 GMT
async_usersync
ib.adnxs.com/ Frame AC62 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:11 GMT
AN-X-Request-Uuid
16a3a2d5-bcb6-4074-8a5e-8b16c1c74fc0
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
analytics.js
www.google-analytics.com/ 		51 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::200e Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 20 Jun 2023 18:39:17 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
3894
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Tue, 20 Jun 2023 20:39:17 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame BD08 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152216
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da6814859eb4400-EWR
expires
Thu, 31 Dec 2037 23:55:55 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 274F 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152216
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da681490ac64400-EWR
expires
Thu, 31 Dec 2037 23:55:55 GMT
async_usersync
ib.adnxs.com/ Frame 0451 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:11 GMT
AN-X-Request-Uuid
a3c90650-5686-4d16-b5d9-22128e3eb9fe
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame 0CBF 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:11 GMT
AN-X-Request-Uuid
79eeac46-69bc-4d72-8c52-2b96776ef9bc
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 02AC
Redirect Chain
  • https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zF7KIcpbyyLXC8N1nw_eds0PliTXDJB1zQzLDEcp
42 B
561 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zF7KIcpbyyLXC8N1nw_eds0PliTXDJB1zQzLDEcp
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:10 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
date
Tue, 20 Jun 2023 19:44:11 GMT
expires
Fri, 04 Aug 1978 12:00:00 GMT
location
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=zF7KIcpbyyLXC8N1nw_eds0PliTXDJB1zQzLDEcp
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma
no-cache
strict-transport-security
max-age=86400
Pug
simage2.pubmatic.com/AdServer/ Frame 71B8
Redirect Chain
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
  • https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d47e24dc-0fa2-11ee-ac94-72b4b480830c
42 B
243 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d47e24dc-0fa2-11ee-ac94-72b4b480830c
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:10 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, proxy-revalidate
content-length
0
content-type
image/gif
date
Tue, 20 Jun 2023 19:44:11 GMT
expires
Thu, 23 Sep 2004 17:42:04 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=d47e24dc-0fa2-11ee-ac94-72b4b480830c
p3p
CP="NOI OTC OTP OUR NOR"
pragma
no-cache
server
Cowboy
x-realserver-nx
lga-delivery-10
Pug
simage2.pubmatic.com/AdServer/ Frame D087
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
42 B
95 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:54:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

cache-control
no-cache
content-length
0
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:11 GMT
expires
Tue, 20 Jun 2023 00:00:00 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
804307
strict-transport-security
max-age=31536000; preload;
x-errorlevel
0
Pug
simage2.pubmatic.com/AdServer/ Frame 481F
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=cuj0HMYUXER6RDS6pY-AEJU4mbI&gdpr=0&gdpr_consent=
42 B
381 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=cuj0HMYUXER6RDS6pY-AEJU4mbI&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:11 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Connection
keep-alive
Content-Length
188
Content-Type
text/html; charset=utf-8
Date
Tue, 20 Jun 2023 19:44:11 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=cuj0HMYUXER6RDS6pY-AEJU4mbI&gdpr=0&gdpr_consent=
Pug
simage2.pubmatic.com/AdServer/ Frame 24BB
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:NWVHfDIW1QbHgT5&gdpr=0&gdpr_consent=
42 B
301 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:NWVHfDIW1QbHgT5&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:11 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:11 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:NWVHfDIW1QbHgT5&gdpr=0&gdpr_consent=
Pragma
no-cache
Server
PingMatch/v2.0.30-780-gdfb6b2e#rel-ec2-master i-080ca4cd6cc01412e@us-east-1b@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
pbmtc.gif
beacon.lynx.cognitivlabs.com/ Frame 670B
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=50113f91-7ace-4204-934b-46770b6d07a4&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
42 B
509 B 		Document
General
Check archive.org
Download Go to
Full URL
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.204.237.207 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-204-237-207.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
42
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:11 GMT
Server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
date
Tue, 20 Jun 2023 17:54:29 GMT
location
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
Pug
simage2.pubmatic.com/AdServer/ Frame 8768
Redirect Chain
  • https://ums.acuityplatform.com/tum?umid=6
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501171541
42 B
288 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501171541
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:11 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Access-Control-Allow-Origin
*
Content-Length
0
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501171541
Pug
simage2.pubmatic.com/AdServer/ Frame 6CAC
Redirect Chain
  • https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent=
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
42 B
287 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:10 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:11 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
i.match
a.tribalfusion.com/ Frame E777 		43 B
473 B 		Document
General
Check archive.org
Download Go to
Full URL
https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache private
cf-cache-status
DYNAMIC
cf-ray
7da6814a1b4833fb-YUL
content-length
43
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:11 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
x-function
302
Pug
simage2.pubmatic.com/AdServer/ Frame EE38
Redirect Chain
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4475188502
  • https://sync.1rx.io/usersync/tradedesk/59f17c06-c5d2-4b1e-89aa-3d64ff091022
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
42 B
335 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:11 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:11 GMT
ETag
RX64d977bfa2a9423a8d0b404f4e0c5937005
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Transfer-Encoding
chunked
Pug
simage2.pubmatic.com/AdServer/ Frame 6EB1
Redirect Chain
  • https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
0
74 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:12 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:12 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server
_
Pug
image2.pubmatic.com/AdServer/ Frame 2BFC
Redirect Chain
  • https://gocm.c.appier.net/pubmatic
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=eTsnmm5VDg6trxz8jAGSZA
42 B
280 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=eTsnmm5VDg6trxz8jAGSZA
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:54:33 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

accept-ch
Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cache-control
no-store
content-length
153
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:12 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=eTsnmm5VDg6trxz8jAGSZA
p3p
CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
nginx
cm
ipac.ctnsnet.com/int/ Frame 0615 		43 B
369 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
173.193.186.35.bc.googleusercontent.com
Software
Apache-Coyote/1.1 /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
43
content-type
image/gif
date
Tue, 20 Jun 2023 19:44:10 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
CP="NOI DSP COR NID CUR OUR NOR"
pragma
no-cache
server
Apache-Coyote/1.1
via
1.1 google
Pug
image2.pubmatic.com/AdServer/ Frame 36A6
Redirect Chain
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=a457c9e9-2914-4c4f-865e-b60bc0f898f7
1 B
53 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=a457c9e9-2914-4c4f-865e-b60bc0f898f7
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
1
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 17:54:25 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:12 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=a457c9e9-2914-4c4f-865e-b60bc0f898f7
strict-transport-security
max-age=15724800; includeSubDomains
pub
matching.truffle.bid/sync/ Frame E071 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.55.120.196 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.196.120.55.162.clients.your-server.de
Software
nginx/1.23.3 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:12 GMT
Server
nginx/1.23.3
Strict-Transport-Security
max-age=15768000
cookiesync
core.iprom.net/ Frame CFE4 		43 B
279 B 		Document
General
Check archive.org
Download Go to
Full URL
https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
close
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:12 GMT
Vary
Accept-Encoding
X-adserver-worker
komodo-527f3cd22525@version_1.556v2
X-core-time
0ms
X-server-arch
v2
Pug
simage2.pubmatic.com/AdServer/ Frame 04FE
Redirect Chain
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7405766521439522184&uid=Q740576652143952...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766521439522184
42 B
95 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766521439522184
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:54:26 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Cache-Control
max-age=43411
Connection
keep-alive
Content-Length
154
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:12 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766521439522184
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
Apache/2.4.6 (CentOS)
Vary
Accept-Encoding
X-Powered-By
PHP/7.3.33
Pug
simage2.pubmatic.com/AdServer/ Frame 73CF
Redirect Chain
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:FCA67877EA764E1F821EE4EC1A0C959E&gdpr=0&gdpr_consent=
1 B
72 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:FCA67877EA764E1F821EE4EC1A0C959E&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
1
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:09 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-length
142
content-type
text/html
date
Tue, 20 Jun 2023 19:44:11 GMT
expires
Mon, 19 Jun 2023 19:44:11 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:FCA67877EA764E1F821EE4EC1A0C959E&gdpr=0&gdpr_consent=
server
openresty
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
458249.gif
idsync.rlcdn.com/ Frame 415C
Redirect Chain
  • https://idsync.rlcdn.com/712188.gif?partner_uid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
  • https://pippio.com/api/sync?pid=5324&it=1&iv=ddd341f48edd8544487039c681569751b5788b7f9c24d5845205132461989c45791426b5417dce21&_=2
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBkZGQzNDFmNDhlZGQ4NTQ0NDg3MDM5YzY4MTU2OTc1MWI1Nzg4YjdmOWMyNGQ1ODQ1MjA1MTMyNDYxOTg5YzQ1NzkxNDI2YjU...
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBkZGQzNDFmNDhlZGQ4NTQ0NDg3MDM5YzY4MTU2OTc1MWI1Nzg4YjdmOWMyNGQ1ODQ1MjA1MTMyNDYxOTg5YzQ1NzkxNDI2YjU0MTdkY2UyMRAAGgwIjIPIpAYSBAgCEABCAEoA&goog...
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
  • https://idsync.rlcdn.com/458249.gif?partner_uid=403238cf-5851-423a-9dbf-f9cc07c258c7
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/458249.gif?partner_uid=403238cf-5851-423a-9dbf-f9cc07c258c7
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:13 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/458249.gif?partner_uid=403238cf-5851-423a-9dbf-f9cc07c258c7
date
Tue, 20 Jun 2023 19:44:13 GMT
via
1.1 google
x-samesite
secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111
content-type
text/html; charset=utf-8
gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9/gdpr=0/ Frame 415C 		49 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9/gdpr=0/gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.20.148.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-20-148-40.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:11 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.15.72
content-length
49
expires
0
receive
pixel.tapad.com/idsync/ex/ Frame 415C 		95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95
/
bpi.rtactivate.com/tag/ Frame 415C 		43 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bpi.rtactivate.com/tag/?id=20909&user_id=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.16.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-16-231.compute-1.amazonaws.com
Software
awselb/2.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:12 GMT
server
awselb/2.0
content-length
43
content-type
image/gif
Pug
simage2.pubmatic.com/AdServer/ Frame 415C
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://c1.adform.net/serving/cookie/match?CC=1&party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1598040676591792150
42 B
321 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1598040676591792150
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:12 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1598040676591792150
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame 415C
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=1179662177681492769
42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=1179662177681492769
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:11 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Tue, 20 Jun 2023 19:44:12 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
7d1229c3-21d1-481b-a6d8-a59690893822
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=1179662177681492769
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 415C
Redirect Chain
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:59a5b5f7-4084-4fca-af03-1a5d040bf2c3&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:59a5b5f7-4084-4fca-af03-1a5d040bf2c3&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:12 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:59a5b5f7-4084-4fca-af03-1a5d040bf2c3&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date
Tue, 20 Jun 2023 19:44:12 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
drop_cookie_sw.php
csync.smilewanted.com/ Frame 332A 		0
345 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814afd644400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding
get
choices.trustarc.com/ Frame 8832 		287 B
638 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P1
age
156920
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
BQsqTByXSJPxvp5Ud25OhpPL_dggNOR98Dmgym_WXcmuHxLap6n3QQ==
expires
Wed, 19 Jul 2023 00:08:52 GMT
async_usersync
ib.adnxs.com/ Frame 8B37 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:12 GMT
AN-X-Request-Uuid
15f53d61-308f-4c6b-8d6a-88ea18640329
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
G2VgiPZHAzppHjhCRtWlW-BH
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame D596
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
0
392 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814beeb24400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:12 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
X-Sovrn-Pod
ad_ap1dca1
/
sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/ Frame 9398
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsync.richaudience.com%2F1a12a024f8f9561c49164bbaf87ed164%2F%3Fuid%3D[sas_uid]&gdpr_consent=&nwid=2441/
  • https://sync.smartadserver.com/getuid?url=https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=[sas_uid]&gdpr_consent=&nwid=2441/&cklb=1
  • https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4614819635623485669
95 B
361 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4614819635623485669
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
167.235.114.248 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.248.114.235.167.clients.your-server.de
Software
nginx / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:44:11 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx
x-powered-by
PHP/8.2.4

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:12 GMT
location
https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4614819635623485669
drop_cookie_sw.php
csync.smilewanted.com/ Frame 1290 		0
90 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814c1f0e4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding
vevent
nym1-ib.adnxs.com/ Frame 1CC2 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLvCvBMbwUAAAMA1gAFAQiGg8ikBhC4js7X6Z24uA4YoZat_YGQwK8QKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlCH1L2uAVi5q5cBYABopq60AXjFxgWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaHVmKCdhJywgNDI1NDI5MCwgMCk7dWYoJ2kFFBg2MDgyMCwgDRQsZycsIDExNjI0MDIyFRUAYwEpGDA2MjAwMTcVFTByJywgMzY1OTE0NjMxBRbwi5ICvQQhZEcxU2Z3anhuNjhURUlmVXZhNEJHQUFndWF1WEFUQUVPQUJBQUVpUkNGRHUzOEVOV0FCZ2dRWm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUkNvQVFxd0FRQzVBVGVqeW1tVWxDY193UUUzbzhwcGxKUW5QOGtCQUFBQUFBQUEwRF9aQVFBCQ50UEFfNEFIVWg0UUM5UUZ2MDlvNW1BSUFvQUlCdFFJBSQAdg0I8JV3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01YQ0xLUndDd1FCaGdCTFVaUElEUXlCelkwTmpNek5ET2lBeE1Jd1lfQUxCQUtHQUV0QUFDQVBqSURkVzVydWdNSlRsbE5Nam8xTXpVMDRBUHBRNEFFNlpMa0E0Z0UwSlBrQTVBRUFaZ0VBY0VFQUEFoxRBQUFESkIBBw0BGDJBUUE4UVENDmBBQUFJZ0Y2aW1wQmRPa0ZIUjdTZTBfc1FVARoJATxNRUZBQUJBOFlOYVBUX0pCATscT0MtMGUwXzAuKAAITmtGCTHwQ0FBOERfZ0JSTHdCZGE4eFFYNEJkTFVnd0tDQmdOVlUwU0lCZ1NRQmdHWUJnQ2hCaC1GNjFHNEh2VV9xQVlFc2dZa0NREUoIQUFFAXANAQBHHQwASR0MNHVBWUuaApkBIUZ4VU1IPkECNExtcmx3RWdBQ2dBTVItFW1MT2dsT1dVMHlPalV6TlRSQTZVTkoNaBBBOEQ5UhEMDEFBQlodDABoHQwAcB0MAHgdDAw0QUlrNXT0SAE4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xNzioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQOMTA0MSNOWU0yOjUzNTTaBAIIAeAEAfAEh9S9rgGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXXtx76BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGmAPaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgHxcYF0gcNCS4xABTaBwYIABABOmQHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=97ae985201d796a34b8890df8cc87bbedcaf6017&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7756278961844469817&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:12 GMT
AN-X-Request-Uuid
2b18d544-0a95-4036-a38b-e01d0226a4c7
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame EB3E
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F2069.66%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=167503462
  • https://sync.1rx.io/usersync3/mediamathtest/2069.66/c0d66492-0183-4f00-930f-e67415c7188d?zcc=0&sspret=1
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-64d977bf-a2a9-423a-8d0b-404...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
0
400 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814eba2f4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:12 GMT
ETag
RX64d977bfa2a9423a8d0b404f4e0c5937005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Transfer-Encoding
chunked
get
choices.trustarc.com/ Frame 667F 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=672780485&js=pmw2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P1
age
156920
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
RN2VYleZr2TVV4lxqrVP6028gwEJ8vnUw4lLsPUktW8QTK88eJ6Snw==
expires
Wed, 19 Jul 2023 00:08:52 GMT
get
choices.trustarc.com/ Frame 667F 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Sun, 18 Jun 2023 12:17:59 GMT
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P1
age
199573
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
739
x-amz-cf-id
jd5s1xIDM0U6v3K7UrMmWmCtz37tWhYNMv1xAJL26Z1xNi4NavE4Dw==
expires
Tue, 18 Jul 2023 12:17:59 GMT
drop_cookie_sw.php
csync.smilewanted.com/ Frame CE70 		0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814e39b14400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pe&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&f_privb=0&tid=ab715557-d9e8-49f3-9ddf-c549b37e9f4b&pid=45fbb049-cd4d-4548-b342-1bd2d9960567&dtm=1687290252488&qnm=_matherq&visible=1&tabid=d1035f59-8a38-44c6-83f8-8befa73f770a&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x8818&tofa=1687290242&vid=1&lvidt=1687290242&duid=ba10b823-5015-4d9c-bc8f-648a9ff50d11&fp=967226427&cid=ma23578&mrk=239876506&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTY4NzI5MDIzOTA4NiIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiI1Ni44bWIiLCJoZWFwVCI6IjcyLjJtYiIsImZzdFBhaW50IjoiOTkzIiwiZmV0Y2hTIjoiMCIsImRvbWFpblMiOiIyIiwiZG9tYWluRSI6IjEzIiwiY29ublMiOiIxMyIsImNvbm5FIjoiNDkiLCJzc2xTIjoiMjkiLCJyZXF1UyI6IjQ5IiwicmVzcFMiOiI2NiIsInJlc3BFIjoiOTYiLCJkb21Mb2FkIjoiNzAiLCJkb21JbnRlciI6IjEzNTAiLCJkb21Mb2FkUyI6IjEzODAiLCJkb21Mb2FkRSI6IjE0MTUifX0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:12 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
2f81eaed-0776-53ab-ae15-6ab4ca876b38
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame E648
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
0
599 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814f1a994400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
client
ssl.connextra.com/CFL/selector/ Frame 0F44 		969 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssl.connextra.com/CFL/selector/client?client=CFL&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&_cb=189151553&apnauc=1385579407814183431&bidid=1385579407814183431&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA./bcr=AAAAAAAA8D8=/cnd=%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8./cca=NzMyMCNOWU0yOjUzNDU=/bn=75718/clickenc=
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.69.48.172 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-69-48-172.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
c48759fde37b3ae4312d1726735c09ffb39965c5e39beb88cef202ff9e5ed28a

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-length
636
content-type
text/html;charset=utf-8
date
Tue, 20 Jun 2023 19:44:12 GMT
expires
Tue, 20 Jun 2023 19:44:12 GMT
p3p
CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV
pragma
no-cache
server
istio-envoy
vary
* Accept-Encoding
x-envoy-upstream-service-time
2
x-served-by
adserver-blue-6
async_usersync.html
acdn.adnxs.com/dmp/ Frame 11EE 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:12 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:14 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
rd_log
nym1-ib.adnxs.com/ Frame 1309 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLrDPQXAWsGAAADANYABQEIhoPIpAYQh5Tx1pWkpJ0TGKGWrf2BkMCvECo2CdcbZmXxvJ4_EfVg_aBpN5c_GQAAAIDC9fA_IWVyeZLFFKE_KVq77UJznaY_MQAAACCF67E_MO7fwQ04mFBAmDlIAlDW563TAVi5q5cBYABopq60AXjGzwSAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNjAzODY4OCwgMCk7dWYoJ2knLCA3MzYxODkwLCAwKTt1ZignZycsIDE4Mjk2ODA0LCAwKTt1ZigncycsIDI3NTYxOTAwMCwgMCk7dWYoJ3InLCA0NDMyNDk2MjIFVfCLkgKhBCFBR19oYndqUXVMQVpFTmJucmRNQkdBQWd1YXVYQVRBQ09BQkFBRWlZT1ZEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRcW9BUXF3QVFDNUFTT3htZWZzbktZX3dRRWpzWm5uN0p5bVA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUhpcXNFRDlRRzhYYk05bUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DSXl5dmlJUUN4Z0NMUUFBQUFDNkF3bE9XVTB5T2pVek5EWGdBLWxEZ0FUZl80NExpQVRBOE5rSWtBUUJtQVFCd1EFNQkBCE1rRQkJAQEYRFlCQUR4QgELDQF4aUFYaEtaZ0Z1TG0yZ3dHcEJkT2tGSFI3U2UwX3NRVQUmHDB3emxQOEVGBQ0cTk1NMVRfSkIBYxxPQzFDdEVfMA0oBQEETmsJKCko8EBnQmNFaThBWGszOXdJLUFXZ3lmQUNnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkFrQQFIBQEAQh3HBEJrBRMFAQBDHRhETGdHQ2cuLpoCmQEhdlJieXRBOiUCZExtcmx3RWdBQ2dBTWR2NWZtcThkTzhfT2dsPV0UVkE2VU5KBV0FxQQ5UgEICQEEQloJCAEBBEJoAQYJAQRCcAkIAQEEQngBBgkBEEI0QUlrNXDgOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL_ICEQoGQURWX0lEEgc2aVcc8gISCgZDUEcBFAgIMThpQwEVCAVDUAEUFAkyNzU2MWFCOPICDQoIQURWX0ZSRVESAQkQHFJFTV9VU0VSBRAADAkgGENPREUSAPIBDwFZEQ8QCwoHQ1AVDhAQCgVJTwFhBAc3acwA8gEhBElPFSE4EwoPQ1VTVE9NX01PREVMASsUAPICGgoWMhYAHExFQUZfTkFNBXEIHgoaNh0ACEFTVAE-EElGSUVEAT4cFQoIU1BMSVQBTRnZ8IaAAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE3OKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA43MzIwI05ZTTI6NTM0NdoEAggB4AQB8ASlOiCIBQGYBQCgBf8RARgBwAUAyQUABQEU8D_SBQkJBQt8AAAA2AUB4AUB8AWiiQf6BQQIABAAkAYAmAYAuAYAwQYBITAAAPA_0AapJdoGFgoQCREZAaAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgHxs8E0gcNCREzATEI2gcGAWhwGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=e07ad8d52b2901cfb37751c66091233d070beb28&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dwfeqdiirq%26e%3D1069342552190,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dwfeqdiirq%26e%3D1069342552190&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:12 GMT
AN-X-Request-Uuid
536f7e94-69fe-49b1-89bb-329254baaf84
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame 1309 		80 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 14 Jun 2024 13:01:02 GMT
Date
Tue, 20 Jun 2023 19:44:12 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
456189
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
27646
X-Served-By
cache-lga21928-LGA, cache-yul12830-YUL
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
X-Timer
S1687290253.538767,VS0,VE0
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Accept-Ranges
bytes
X-Cache-Hits
5, 66352
it
nym1-ib.adnxs.com/ Frame 1309 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLUCvQXAVQFAAADANYABQEIhoPIpAYQh5Tx1pWkpJ0TGKGWrf2BkMCvECo2CdcbZmXxvJ4_EfVg_aBpN5c_GQAAAIDC9fA_IWVyeZLFFKE_KVq77UJznaY_MQAAACCF67E_MO7fwQ04mFBAmDlIAlDW563TAVi5q5cBYABopq60AXjGzwSAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNjAzODY4OCwgMCk7dWYoJ2knLCA3MzYxODkwLCAwKTt1ZignZycsIDE4Mjk2ODA0LCAwKTt1ZigncycsIDI3NTYxOTAwMCwgMCk7dWYoJ3InLCA0NDMyNDk2MjIFVfCLkgKhBCFBR19oYndqUXVMQVpFTmJucmRNQkdBQWd1YXVYQVRBQ09BQkFBRWlZT1ZEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRcW9BUXF3QVFDNUFTT3htZWZzbktZX3dRRWpzWm5uN0p5bVA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUhpcXNFRDlRRzhYYk05bUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DSXl5dmlJUUN4Z0NMUUFBQUFDNkF3bE9XVTB5T2pVek5EWGdBLWxEZ0FUZl80NExpQVRBOE5rSWtBUUJtQVFCd1EFNQkBCE1rRQkJAQEYRFlCQUR4QgELDQF4aUFYaEtaZ0Z1TG0yZ3dHcEJkT2tGSFI3U2UwX3NRVQUmHDB3emxQOEVGBQ0cTk1NMVRfSkIBYxxPQzFDdEVfMA0oBQEETmsJKCko8EBnQmNFaThBWGszOXdJLUFXZ3lmQUNnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkFrQQFIBQEAQh3HBEJrBRMFAQBDHRhETGdHQ2cuLpoCmQEhdlJieXRBOiUCZExtcmx3RWdBQ2dBTWR2NWZtcThkTzhfT2dsPV0UVkE2VU5KBV0FxQQ5UgEICQEEQloJCAEBBEJoAQYJAQRCcAkIAQEEQngBBgkBEEI0QUlrNXD0SAE4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xNzioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjUzNDXaBAIIAeAEAfAE1uet0wGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWiiQf6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGqSXaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgHxs8E0gcNCS4xABTaBwYIABABOmQHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=97885f2be7ebf0c375c11dab829b2e7e729d6e6f
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:12 GMT
AN-X-Request-Uuid
3a2c740b-7135-4f45-b263-183327975c77
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
G2VgiPZHAzppHjhCRtWlW-BH
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame F342
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814eba314400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:12 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
X-Sovrn-Pod
ad_ap1dca1
usync.html
eus.rubiconproject.com/ Frame 0786 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:12 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 9E8D 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:12 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:14 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4186 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165942
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:12 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 267C 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814f0a864400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 8DE5
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1598040676591792150&gdpr=0&gdpr_consent=
43 B
740 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1598040676591792150&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1598040676591792150&gdpr=0&gdpr_consent=
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
/
rtb-csync.smartadserver.com/redir/ Frame 8DE5
Redirect Chain
  • https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent=
  • https://stags.bluekai.com/site/23178?id=7dYANMJyrp6NSRwK_hfM&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33N...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC...
  • https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=7dYANMJyrp6NSRwK_hfM
43 B
806 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=7dYANMJyrp6NSRwK_hfM
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:13 GMT
Content-Type
text/html; charset=utf-8
Location
https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=7dYANMJyrp6NSRwK_hfM
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
140
Expires
Thu, 01 Dec 1994 16:00:00 GMT
/
wt.rqtrk.eu/ Frame 8DE5
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=150&partneruserid=0&redirurl=https%3A%2F%2Fwt.rqtrk.eu%3Fpid%3D58a76248-f101-4e52-b8f7-c4de9362ea12%26src%3Dwww%26type%3D100%26sid%3D0%26...
  • https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=4614819635623485669&gdpr_pd=0&gdpr=0&gdpr_consent=
43 B
350 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://wt.rqtrk.eu/?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=4614819635623485669&gdpr_pd=0&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
15.235.42.103 Victoria, Canada, ASN16276 (OVH, FR),
Reverse DNS
haproxy-ca-002.roqad.pl
Software
istio-envoy /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
server
istio-envoy
p3p
CP="NOI DSP COR DEVa PSAa PSDa OUR BUS UNI COM NAV STA"
content-type
image/gif
cache-control
no-cache,private
x-envoy-upstream-service-time
0
content-length
43
expires
Tue, 20 Jun 2023 19:44:11 GMT

Redirect headers

location
https://wt.rqtrk.eu?pid=58a76248-f101-4e52-b8f7-c4de9362ea12&src=www&type=100&sid=0&uid=4614819635623485669&gdpr_pd=0&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
rtb-csync.smartadserver.com/redir/ Frame 8DE5
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIBgwATV5hRfwBa&gdpr=0&gdpr_consent=
43 B
737 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIBgwATV5hRfwBa&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

x-served-by
cache-yul12831-YUL
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687290253.635469,VS0,VE0
x-cache
HIT
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIBgwATV5hRfwBa&gdpr=0&gdpr_consent=
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
/
rtb-csync.smartadserver.com/redir/ Frame 8DE5
Redirect Chain
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
43 B
781 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:12 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
date
Tue, 20 Jun 2023 19:44:12 GMT
server
_
content-length
0
c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 60DF
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
0
480 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814fcb624400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:12 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
f6146743-46db-4d85-a9f2-1zz1687290251
csync.smilewanted.com/set_partner_userid_get/richaudience/ Frame 9B3B
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
0
461 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681500ba84400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:11 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
server
nginx
x-powered-by
PHP/8.2.4
1598040676591792150
csync.smilewanted.com/set_partner_userid_get/adform/ Frame A3CE
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
0
546 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681519d8d4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:12 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
server
nginx
RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame 0A01
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005&rndcb=6833292075
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6&google_hm=YjkwNmQyMjUtMWQ1OC00NTAwLTg4OTMtNjZmM2I1ZGUw...
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEKeIIuep3Xkerh_lyfI-wV0&google_cver=1&ssp=adconductor&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://sync.1rx.io/usersync/bidswitch/b906d225-1d58-4500-8893-66f3b5de01e6?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-64d977bf-a2a9-423a-8d0b-404...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681571c514400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:13 GMT
ETag
RX64d977bfa2a9423a8d0b404f4e0c5937005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Transfer-Encoding
chunked
b1b4adf21f61e81a769b8775ed80349d
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 8D29
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/b1b4adf21f61e81a769b8775ed80349d?gdpr_consent=&gdpr=0
0
677 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/b1b4adf21f61e81a769b8775ed80349d?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681504be84400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:12 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/b1b4adf21f61e81a769b8775ed80349d?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290252751057-135
2f81eaed-0776-53ab-ae15-6ab4ca876b38
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 9343
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
0
448 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814fbb4b4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 5F6B
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
474 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814fcb584400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:12 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame CF86
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
0
466 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814ffb8f4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:12 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 302B
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
0
469 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814ffb914400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:12 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
1598040676591792150
csync.smilewanted.com/set_partner_userid_get/adform/ Frame EA17
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681519d8f4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:12 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
server
nginx
2LK2FelB5bz5w6flSs8Z
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 00B9
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
0
438 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681504be54400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:12 GMT Tue, 20 Jun 2023 19:44:12 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
pragma
no-cache
786d8431951ad79f9258aa2cfb14821
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 0807
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/786d8431951ad79f9258aa2cfb14821?gdpr_consent=&gdpr=0
0
720 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/786d8431951ad79f9258aa2cfb14821?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681510ce14400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:12 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/786d8431951ad79f9258aa2cfb14821?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290252877062-305
G2VgiPZHAzppHjhCRtWlW-BH
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame B345
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
0
660 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814ffb8e4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:12 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
X-Sovrn-Pod
ad_ap1dca1
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame FB27
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
454 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6814ffb8b4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:12 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
f6146743-46db-4d85-a9f2-1zz1687290251
csync.smilewanted.com/set_partner_userid_get/richaudience/ Frame B1FB
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
0
528 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681507c2b4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:11 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
server
nginx
x-powered-by
PHP/8.2.4
d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 1595
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
0
112 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681500baa4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:12 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame F31D
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005&rndcb=7373225786
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=adconductor
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=1598040676591792150&ssp=adconductor
  • https://sync.1rx.io/usersync/bidswitch/b906d225-1d58-4500-8893-66f3b5de01e6?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-64d977bf-a2a9-423a-8d0b-404...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
0
548 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681518d784400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:13 GMT
ETag
RX64d977bfa2a9423a8d0b404f4e0c5937005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Transfer-Encoding
chunked
2LK2FelB5bz5w6flSs8Z
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame A0BC
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
0
526 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681509c4c4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:12 GMT Tue, 20 Jun 2023 19:44:12 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
pragma
no-cache
usync.js
eus.rubiconproject.com/ Frame 0786 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:12 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 03:39:20 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=28508
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 03:39:20 GMT
2f81eaed-0776-53ab-ae15-6ab4ca876b38
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame F5E1
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
0
442 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681511ce84400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame E76A
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
0
516 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681507c2a4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:12 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
1598040676591792150
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 5C1B
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681519d8e4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:12 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
server
nginx
get
choices.trustarc.com/ Frame D142 		287 B
629 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=28666691&js=st_2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P1
age
156920
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
EXJoDxcIcCtQjiX4JMEx_X0xt7bsdGdxPiHHBPexYoYgvAGENxMPJA==
expires
Wed, 19 Jul 2023 00:08:52 GMT
get
choices.trustarc.com/ Frame D142 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=28666691&js=st_2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.47.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-47-67.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Sun, 18 Jun 2023 12:17:59 GMT
via
1.1 80d5d65d27a0450c8f0018381b103d7a.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P1
age
199573
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
739
x-amz-cf-id
MbpQnG6a3tMX7d7gZ-vk25yL-zqPJfzqkX3KqNJ37Q9_rJR0m8ceog==
expires
Tue, 18 Jul 2023 12:17:59 GMT
6b571ac5d581a2d9c72211d31d6d776
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 46D5
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/6b571ac5d581a2d9c72211d31d6d776?gdpr_consent=&gdpr=0
0
505 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/6b571ac5d581a2d9c72211d31d6d776?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68151ede64400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:13 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/6b571ac5d581a2d9c72211d31d6d776?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290253034030-119
controller
ssl.connextra.com/servlet/ Frame 5368 		1 KB
854 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=1385579407814183431&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjUzNDU%3D%2Fbn%3D75718%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=1385579407814183431&_cb=189151553
Requested by
Host: ssl.connextra.com
URL: https://ssl.connextra.com/CFL/selector/client?client=CFL&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&_cb=189151553&apnauc=1385579407814183431&bidid=1385579407814183431&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA./bcr=AAAAAAAA8D8=/cnd=%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8./cca=NzMyMCNOWU0yOjUzNDU=/bn=75718/clickenc=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.69.48.172 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-69-48-172.deploy.static.akamaitechnologies.com
Software
istio-envoy /
Resource Hash
b3d0a0b4d857b709736ab97f8ae450f34c96e6e6a5422388708177747ea34f13

Request headers

Referer
https://ssl.connextra.com/CFL/selector/client?client=CFL&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&_cb=189151553&apnauc=1385579407814183431&bidid=1385579407814183431&dspid=3bc1d7fd2e&tclk=https://nym1-ib.adnxs.com/click?1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA./bcr=AAAAAAAA8D8=/cnd=%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8./cca=NzMyMCNOWU0yOjUzNDU=/bn=75718/clickenc=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-encoding
gzip
content-length
677
content-type
text/html;charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
expires
Tue, 20 Jun 2023 19:47:39 GMT
server
istio-envoy
vary
Accept-Encoding
x-envoy-upstream-service-time
2
x-served-by
adserver-blue-6
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame ABCF
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
558 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681519d904400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:13 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 2408
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
0
523 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68151ddd74400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:13 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
2LK2FelB5bz5w6flSs8Z
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 539D
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
0
109 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681528e694400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:13 GMT Tue, 20 Jun 2023 19:44:13 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
pragma
no-cache
Utils_v9-long.js
ssl.connextra.com/services/ActiveAd/ Frame 5368 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.connextra.com/services/ActiveAd/Utils_v9-long.js
Requested by
Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=1385579407814183431&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjUzNDU%3D%2Fbn%3D75718%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=1385579407814183431&_cb=189151553
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.69.48.172 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-69-48-172.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
93e6639c3f07cb77467754907778fc49a74b1194368a93923c824ebec4d78298

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=1385579407814183431&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjUzNDU%3D%2Fbn%3D75718%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=1385579407814183431&_cb=189151553
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:13 GMT
content-encoding
gzip
last-modified
Mon, 07 Jun 2010 11:57:50 GMT
server
AkamaiNetStorage
etag
"159f636ee9f642a0c8c12354adf10d7c:1275911870"
vary
Accept-Encoding
content-type
application/x-javascript
accept-ranges
bytes
content-length
1742
event.png
tpsc-ue1.doubleverify.com/ Frame D4EB 		0
234 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tpsc-ue1.doubleverify.com/event.png?impid=d959ce8575ef45d2abad749553887777&flavor=0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&vdur=135&eoid=14&msrjs=3941&sdf=67108870&vit=2&isvelg=1&rmi=16&tltms=127&tetms=37&msltms=47&vltms=135&sei=290&vetms=825&tuviims=349&tuviems=1309&engms=1&engisel=1&dvp_dtcov=4&msrcanlm=394&msrcannum=4&ee_dp_tmads=3498&ismms=85&isumms=84&nvr=6&elmtp=3&isbxdms=3097&b0=100&b11=3013&adhgt=250&adwdth=300&norwdth=300&norhgt=250&vsos=4&dvp_vsosnmr=16&lftb=3113&sftb=3113&msrdp=4&naral=2&vct=512&vphgt=1200&vpwdth=1600&chgt=250&cwdth=300&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=1102&isuiabvms=1102&ispmxpms=1102&engalms=83&dvp_dpr=1&vstsz=758&ee_dp_cvcmeeid=1&metp=1&meeid=1&ttfurm=4127&cbust=1687290253139159
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:13 GMT
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Expires
06/19/2023 19:44:13
async_usersync
ib.adnxs.com/ Frame 11EE 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:13 GMT
AN-X-Request-Uuid
ef9f7eec-81d0-44eb-a9e4-093891d27f67
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 267C 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:13 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152218
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da681526e524400-EWR
expires
Thu, 31 Dec 2037 23:55:55 GMT
async_usersync
ib.adnxs.com/ Frame 9E8D 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:13 GMT
AN-X-Request-Uuid
0e96805d-c53f-4916-8fa1-3da44547fc74
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame AA36 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bhf8GhwGSZNnBLI6doPMPiYK8sAQAAAAAOAHgBAI&bg=!TU6lThrNAAaGYqkwpmI7ADkAdvg8Whtoyr71dLARsIwmVXa6r209NVt_k04SRK4MdYMrHFv9IKCSS4t_W2vBKnp_9aWZzeuBPfsCAAALOVIAAAAGaAEHmQMcseLLYMebc8Noy6zZR2orCG_6ThN-PV4jJ91P33VlRMLc6xkP1HQ6JblSrro2R7OpfAERv4CAuDqFS55Y8jlKAyuiABWNnrA9fYsKc07uUPHHA0ywKfEGWANOQJd7CwPqqoUzhAdIcIN2Ga_edvCNmTSrMjpRZ571e6_Zd5KNK5RVrAnoX1Y44KEa0hB0M5zo3A-sPblJb34MhFmG5i3vm2swwJkKTeclwsgA0eL9mkLGKKQTLurP47iKJ-Lei55aaFBGISjY7ajJCPPChCFvb_d3Sj9ycD-tnwCHu_R51PxVsuOsSivJPy-tZUnmXC3iusCYXzoRlmGW8eqvSaWDAqalZ0yI7RjxaujRdvHz8NpmHGukcDsdcdFEC355KacRGEpfrdHB_20ygF4WNoXLauXXlWP-RoIwQJVubrq3E_tfwluKDwqkZnIhW8X3jbahsFPI1zlygOeOo6WritHUEDQ8ATCGBEtkGc3y0W5t8HYCFsQvFzsq343EoBySf_LXMoPEqtMq1WVYA3wsEgb4Ag2kezlJe03dlW46TeVWeGraDXRbUm_HCBTE1hpn2Ll2NI0reGli61-UcorCkUNPckeEnMbPqg1sNIPnZUTcuuj5p-9n9nHDustAmQdHoCpW7JVfcTvQplVjs_do0j0Ick_1_KvALUk32TktZYQ6gF6SyapXEEb9sWG0Oo43dDzEa-Gj-oQnP2ufqHIwBiPMBbba7c2KqnDcIMOB0_viaaIswDN6KB9ikKfuVsyqgFkY31lPs9uZPWROfodAe9i5vokAUIq428BtKrF1fgc0YsObPf_LBpFSXuQgQrkavJJJcry2ZUNq3-DF6MDRMRdXwDDIa72lW-Qb0FKQqceaXKM2QTDWmroHOXa1kU_i-6n5IDs7Ev82PvVNv1PEXhDFGOlM00EMrlOLy5afHfOwFlQD3BxK9kjZJagCto0MvklcTXKOZ1jsE0vg6nJO13KjeVmNEU866C6ATkTP4NJoXCkPAzDNeIFc7fy8nRcCgA02uzbzAPfhn88IRpgXTuKHPL-jZVTzO1KAW1H1qw
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:13 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame 1309 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLUCvQXAVQFAAADANYABQEIhoPIpAYQh5Tx1pWkpJ0TGKGWrf2BkMCvECo2CdcbZmXxvJ4_EfVg_aBpN5c_GQAAAIDC9fA_IWVyeZLFFKE_KVq77UJznaY_MQAAACCF67E_MO7fwQ04mFBAmDlIAlDW563TAVi5q5cBYABopq60AXjGzwSAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNjAzODY4OCwgMCk7dWYoJ2knLCA3MzYxODkwLCAwKTt1ZignZycsIDE4Mjk2ODA0LCAwKTt1ZigncycsIDI3NTYxOTAwMCwgMCk7dWYoJ3InLCA0NDMyNDk2MjIFVfCLkgKhBCFBR19oYndqUXVMQVpFTmJucmRNQkdBQWd1YXVYQVRBQ09BQkFBRWlZT1ZEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRcW9BUXF3QVFDNUFTT3htZWZzbktZX3dRRWpzWm5uN0p5bVA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUhpcXNFRDlRRzhYYk05bUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DSXl5dmlJUUN4Z0NMUUFBQUFDNkF3bE9XVTB5T2pVek5EWGdBLWxEZ0FUZl80NExpQVRBOE5rSWtBUUJtQVFCd1EFNQkBCE1rRQkJAQEYRFlCQUR4QgELDQF4aUFYaEtaZ0Z1TG0yZ3dHcEJkT2tGSFI3U2UwX3NRVQUmHDB3emxQOEVGBQ0cTk1NMVRfSkIBYxxPQzFDdEVfMA0oBQEETmsJKCko8EBnQmNFaThBWGszOXdJLUFXZ3lmQUNnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkFrQQFIBQEAQh3HBEJrBRMFAQBDHRhETGdHQ2cuLpoCmQEhdlJieXRBOiUCZExtcmx3RWdBQ2dBTWR2NWZtcThkTzhfT2dsPV0UVkE2VU5KBV0FxQQ5UgEICQEEQloJCAEBBEJoAQYJAQRCcAkIAQEEQngBBgkBEEI0QUlrNXD0SAE4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xNzioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjUzNDXaBAIIAeAEAfAE1uet0wGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWiiQf6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGqSXaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgHxs8E0gcNCS4xABTaBwYIABABOmQHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=97885f2be7ebf0c375c11dab829b2e7e729d6e6f&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=7756278961844469817&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&cid=3&cr=nv&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:13 GMT
AN-X-Request-Uuid
9bfcc1ae-572e-484b-a157-29d9f2577fab
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 0283 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQWT8hwGSZJmjLJeboPwPzt-H4AYAAAAAOAHgBAI&bg=!g4ClgNTNAAaGYqkwpmI7ADkAdvg8WhZ4K9a7kZe_dPF4p4TO6Ycqm1pwwgo2d-65NV5K_gbYfiLF52hpoUWjdu3zjnWPLuB0xJYCAAAMH1IAAAAFaAEHCgANjgO5XsqzHxXoSR0Os5kDG725JOl2AJIelj9n5kTc1GW5jS7MNff1olB1dpVKuSptLCVfSvsP9JIS9D-5YjOlPCAX5YIofxANeFM7eB2gpwss1OwA-XkxkgIcxoFGtFJcOBPSNoRhqtiwQjfOZuwppfLfcl3b2gOczzgLO2HRb4bekxLGrzyTEhtNjCkBkCyHWd8PNGbSO3IuW0OKTtgzWnLojTx7WpBaFhajnk6AZAgkp3kYcP3opBqlp6GHwDXYq6aiXVQYlF4Ey_vCseP5czeK4M9rfYFwCE3Jmh6xELPf9gd1HkZ-6FxX3RzaXDcJKhKQSKYE8gG6VHCtPsNA7cm1NBQvk6BTe8YbbLnM5p_HvdRonI6M1WrUi0XjDa-9ZmTICPZ49nmwfRsiOpjHDAczd_xfl5wvO_XBFE3x_V-t08ZHT_r4HtmtrzK_L3sYoFjdoSchYoJwygoPV1CIiLX15WxeIMqrVAssnCVWcZ_YvTvnS8Z0qHhDqbUuKiqdGrlsjW0rpMJkykF5gO7jTVEUFu-PhlNQpL8jVeVZspUmeyZTphEUEXBCvEu3DAul__4WVaLJG6_FPaDPvCTEJjxtFbMXUQFGm6PNd4zyzUWZvEQa2wF8bORAKKF_zSAr5NaDhTIuWGWz2RBFk81aT3u2P2-O8YMOF2_DAnTnPsNWNzYZCFja5QvvP4ty87UGm0LabMxFhER3G9tAqp1zE1oX-ap_dBiu9SC76_Qmj1SOnU_ZNaI8rLpl7YQwev-Dl2aB1UDqhXxXhQY5MwynP8spqpZnPo3Ep9BeIpjsitkPWodvBE7D9zaEh_RCAZaL5Liin7mvJsfB2TB0WwVCOHueH5TJdcgmpdWMLYPy8pDfid1FegCBfDx_WfwwJHA8aD0v5V_5P2PjyAo9cSrtIkgt4i6FajPWobySZtpPA3rozneQBwCY4PJ1W17qjYfV7bIUrnIhCSMUtCIPrrqjpj1Bt9CdBw7a81YiKHGl4qqRM8N50miAwsewU3syLi_bqIukSGRCopsIHqhBNAMWn19meH_CAH3OxG3YuJX9u6S0p_HcB0oDGqgkcQ
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:13 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
generate_204
tpc.googlesyndication.com/ Frame F42A 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?BRtu2w
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:13 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
300x250.jpg
ssl.connextra.com/resources/CFL/2023/F2P_ACQ_US_CA_FantasyEvergreenV1Jun2023/ Frame 5368 		34 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.connextra.com/resources/CFL/2023/F2P_ACQ_US_CA_FantasyEvergreenV1Jun2023/300x250.jpg
Requested by
Host: ssl.connextra.com
URL: https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=1385579407814183431&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjUzNDU%3D%2Fbn%3D75718%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=1385579407814183431&_cb=189151553
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.69.48.172 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-69-48-172.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
112e4437cd11cf2bb4596bd53bf208420b24ee7f5532c92879e23f82c64c77e4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssl.connextra.com/servlet/controller?service=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&pubhost=sopalk.com&apnauc=1385579407814183431&tclk=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3F1xtmZfG8nj_1YP2gaTeXPwAAAIDC9fA_ZXJ5ksUUoT9au-1Cc52mPwdK3FohkToTIUurH4AAXxCGAZJkAAAAAO5vsAEYKAAAmBwAAAIAAADWc2saudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAtiT7HAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%21vRbytAjQuLAZENbnrdMBGLmrlwEgACgAMdv5fmq8dO8_OglOWU0yOjUzNDVA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DNzMyMCNOWU0yOjUzNDU%3D%2Fbn%3D75718%2Fclickenc%3D&client=CFL&dspid=3bc1d7fd2e&placement=DDM_F2P_ACQ_CA_FantasyEvergreenV1Jun2023_300x250&bidid=1385579407814183431&_cb=189151553
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
PBXiw.Qmuo1yAEVVqnW1RyV9M0F6XHYK
date
Tue, 20 Jun 2023 19:44:13 GMT
last-modified
Mon, 05 Jun 2023 08:13:01 GMT
server
AmazonS3
x-amz-request-id
PJQMG3E7R1BWQGMP
etag
"aaf8504da3fc774fdf365fa2eaf9fe04"
x-amz-server-side-encryption
AES256
content-type
image/jpeg
accept-ranges
bytes
content-length
35249
x-amz-id-2
9LFQCxngrl9CLrQJERODe5iSSAIqKD0oPvepKR1teGDsCxN22inrZhBKmx1o/1X4tciqPgsZgmXKVTWEz7j+nA==
drop_cookie_sw.php
csync.smilewanted.com/ Frame E509 		0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681559a9e4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding
G2VgiPZHAzppHjhCRtWlW-BH
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame 0889
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
0
623 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681565b5e4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:13 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgiPZHAzppHjhCRtWlW-BH
X-Sovrn-Pod
ad_ap1dca1
vevent
nym1-ib.adnxs.com/ Frame 1CC2 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLvCvBMbwUAAAMA1gAFAQiGg8ikBhC4js7X6Z24uA4YoZat_YGQwK8QKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlCH1L2uAVi5q5cBYABopq60AXjFxgWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaHVmKCdhJywgNDI1NDI5MCwgMCk7dWYoJ2kFFBg2MDgyMCwgDRQsZycsIDExNjI0MDIyFRUAYwEpGDA2MjAwMTcVFTByJywgMzY1OTE0NjMxBRbwi5ICvQQhZEcxU2Z3anhuNjhURUlmVXZhNEJHQUFndWF1WEFUQUVPQUJBQUVpUkNGRHUzOEVOV0FCZ2dRWm9BSEFBZUFDQUFRQ0lBUUNRQVFHWUFRR2dBUkNvQVFxd0FRQzVBVGVqeW1tVWxDY193UUUzbzhwcGxKUW5QOGtCQUFBQUFBQUEwRF9aQVFBCQ50UEFfNEFIVWg0UUM5UUZ2MDlvNW1BSUFvQUlCdFFJBSQAdg0I8JV3QUlBeUFJQTBBSUEyQUlBNEFJQTZBSUEtQUlBZ0FNQm1BTUJvZ01YQ0xLUndDd1FCaGdCTFVaUElEUXlCelkwTmpNek5ET2lBeE1Jd1lfQUxCQUtHQUV0QUFDQVBqSURkVzVydWdNSlRsbE5Nam8xTXpVMDRBUHBRNEFFNlpMa0E0Z0UwSlBrQTVBRUFaZ0VBY0VFQUEFoxRBQUFESkIBBw0BGDJBUUE4UVENDmBBQUFJZ0Y2aW1wQmRPa0ZIUjdTZTBfc1FVARoJATxNRUZBQUJBOFlOYVBUX0pCATscT0MtMGUwXzAuKAAITmtGCTHwQ0FBOERfZ0JSTHdCZGE4eFFYNEJkTFVnd0tDQmdOVlUwU0lCZ1NRQmdHWUJnQ2hCaC1GNjFHNEh2VV9xQVlFc2dZa0NREUoIQUFFAXANAQBHHQwASR0MNHVBWUuaApkBIUZ4VU1IPkECNExtcmx3RWdBQ2dBTVItFW1MT2dsT1dVMHlPalV6TlRSQTZVTkoNaBBBOEQ5UhEMDEFBQlodDABoHQwAcB0MAHgdDAw0QUlrNXT0SAE4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xNzioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQOMTA0MSNOWU0yOjUzNTTaBAIIAeAEAfAEh9S9rgGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXXtx76BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGmAPaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgHxcYF0gcNCS4xABTaBwYIABABOmQHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=97ae985201d796a34b8890df8cc87bbedcaf6017&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7756278961844469817&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:13 GMT
AN-X-Request-Uuid
83b55a2f-75c9-4bff-bbb1-d7e1a2442afe
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
f6146743-46db-4d85-a9f2-1zz1687290251
csync.smilewanted.com/set_partner_userid_get/richaudience/ Frame A1FF
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
0
604 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681569bad4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:12 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
server
nginx
x-powered-by
PHP/8.2.4
RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame 41E0
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&rndcb=4731358763
  • https://sync.1rx.io/usersync/rubicon/LJ4P1MPG-1E-GIGU
  • https://sync.targeting.unrulymedia.com/csync/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-64d977bf-a2a9-423a-8d0b-404...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
0
585 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68156ec0f4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:13 GMT
ETag
RX64d977bfa2a9423a8d0b404f4e0c5937005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Transfer-Encoding
chunked
2f81eaed-0776-53ab-ae15-6ab4ca876b38
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 053C
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
0
843 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68156bbd14400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
SPug
simage4.pubmatic.com/AdServer/ Frame 415C 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156383&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:13 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 6521
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
0
614 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681573c614400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:13 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/c5c76c6145efa141e23590f30ff9b080f49e59d108c37e066cd57e19bc2eb03e
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
1598040676591792150
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 0464
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
0
644 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681580d524400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:13 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
server
nginx
65b81249c63c3f35944c3539c0ecb4
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame F750
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/65b81249c63c3f35944c3539c0ecb4?gdpr_consent=&gdpr=0
0
683 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/65b81249c63c3f35944c3539c0ecb4?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68157bd074400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:13 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/65b81249c63c3f35944c3539c0ecb4?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
nnCoection
close
x-sticky-vk
1687290253990021-286
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame F29C
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
90 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681580d5a4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:14 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame ABB2
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
0
883 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681585dc14400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:14 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
2LK2FelB5bz5w6flSs8Z
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame AB19
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
0
113 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681590e794400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:14 GMT Tue, 20 Jun 2023 19:44:14 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/2LK2FelB5bz5w6flSs8Z?pi=smilewanted
pragma
no-cache
sodar
pagead2.googlesyndication.com/pagead/ Frame 8DE5 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306150101&jk=2881518130063934&bg=!lJell8PNAAaGYqkwpmI7ADkAdvg8Wr2bwEaw0N225XL1dBAkOwLwKtwk-XyQ3EJx6Ob0HAVZxPfZYjc6k-Bk_3xKQvvoGnBJWagCAAAHtVIAAAAEaAEHCgA_WU2smMJu_F71JIfe3D04uVrTiHjPBuv56VhaRVEIXXlI614EMsHslm9IoNuv7od1qNQrvcGUAUYJJQ0xJN3fmQMWbcHG4dMn33qKMEGFS3G0bZDn_Ad6qVNQ6rmqKxY37TIq66Xv0yp4jHe3d2hT_lHcs4sgp-M49vE-DDYuqGb7YdD91b-ux1tgLgxU8Hc5Jo1ykbBY2M3nZ2rCB_6m0WqctCJk5zEFp22jbI99HynJhAofbxUpJWpClRXwKcT0Wa1iQZVwbSS0FSbH-3HisyomyzApeOkKU_j2sTqsjtW4SFWSC7KJzdiZdTw60DTH5XM2nJnzDN57fK-AoiIfcgS34P1t60UdoHFhamxYvW63i0Esx1cV35PLDlztVA6Rhi-wGo-rPEan7EZ4nYg2CiUDdJdLwXhZLxAYLv8-GDC_0rlTE-_djk_TQBa4XWoYXJYa4SIzBe2cCp-qa9ewgWLU4Xafpe0GJXvATBwba7p7KzDbyhy0XSfIK75UTYgustsRNMzNIjBSJxpcXaaXzKH8o_hPAho7U5VCtEvEcbORlwk6238YLeBDsarQyqXoOGBmH3e9DSfM3S4sDGNOGglfeHxR6nxYBJlPKpXmRq1fVDwzLEMP7Og7N3ZzrL2mViPQwhFGIZEXx8T9kDh8KXEfnGJWxdAriq03W4XOrE9TTJnFb6q_m9XcR0RoL37Zu5M-PVhKlJW96uQLq-xsm6Clsn1N6UfMaa4g6mil6vslnQvgZ8ocWUN2k2suWhk3zAWxBC14aA3M6SfyGTh5wnutPcI4yJ0DKbyYyDKJn_x10ZWn-Aay5BQus1C_-fLtyzelA8C6iF4aZW_v1tzjqf37kDBqsQSM_DbRy3Z5EiVa-Cn8-hW4nJqP7KLF_S6yjtqk-S7cBLON8iWMK1b-lC5we3ZLREVHVLUX-lz2DHbmuc8BlE7-_8jY_OBoE_L87di9K69Re5c83A6HbYA9bzm4lStTAV8esMmIUKXkPNmjplxrHgrD_x1pxrF6SaExQLVXYOfyJehpYXOQ0p3h6E9MiBx7FaLkRAtHOPYgnMAzwnORxRazPCbCAyLwTLWweoQCRt1bluhTGx56dSEDLb6oSx2xfMb3io0TqIdB7I40MFqcqK6fvw
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
614620065398091
connect.facebook.net/signals/config/ 		300 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/614620065398091?v=2.9.107&r=stable
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4424132c76bd3b942b9a4b0dc628dc4cd5826b75022aca28ad4ae6a696f35437
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:44:14 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
87969
x-xss-protection
0
pragma
public
x-fb-debug
9HNJiciuQxOHvmCdI0K6sf1FT/gnvVvXmeJIwdGnPYQjHKU+yrYOSbbU3D0zj6Ym9ydoJgqKyf/E2JS4moIH+g==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		188 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-747356055
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80f::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f8f6e6804f596da6c539bcc54ede0b71b40afbd35e88d00c3a64d5b61218e0de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:14 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
69736
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:44:14 GMT
bat.js
bat.bing.com/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 20 Jun 2023 19:44:13 GMT
last-modified
Thu, 11 May 2023 18:08:27 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 751716F7D0F04F26A021CAF5060DB1D7 Ref B: YMQ01EDGE0414 Ref C: 2023-06-20T19:44:14Z
etag
"80df77953384d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12183
swap.js
cdn.callrail.com/companies/649313642/d272108827995ed1b1b1/12/ 		36 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.callrail.com/companies/649313642/d272108827995ed1b1b1/12/swap.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.83 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-83.ewr53.r.cloudfront.net
Software
/
Resource Hash
a54690656b18f041c597eb704cbc6ee95c571db2ed7460392e7c49b899dcc74f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:14 GMT
via
1.1 0812978283e8debc2d404f4a7b32d866.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-amz-cf-pop
EWR53-P1
x-cache
Miss from cloudfront
x-xss-protection
1; mode=block
x-request-id
0e7e0a1b-53eb-4cf1-a873-5a5ae08cfc8b
x-runtime
0.008864
referrer-policy
strict-origin-when-cross-origin
etag
W/"a54690656b18f041c597eb704cbc6ee9"
x-download-options
noopen
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600, public
timing-allow-origin
*
x-amz-cf-id
dGQg_SsofLFuexBa0_yfybqoRVP1XNKEHZa1Du1fi7Dssz-s3EroPA==
usermatch.gif
beacon.krxd.net/
Redirect Chain
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:6swk5ma&fmt=3
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Protocol
H2
Server
34.196.240.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-240-226.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
beacon-n012-ash-prod.krxd.net
date
Tue, 20 Jun 2023 19:44:14 GMT
cache-control
private, no-cache, no-store
x-request-time
D=35 t=1687290254
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
date
Tue, 20 Jun 2023 19:44:14 GMT
x-cache-hits
0
x-age
0
content-length
0
x-cache
MISS
x-served-by
usermatch-a004-ash-prod.krxd.net
usermatch.gif
beacon.krxd.net/
Redirect Chain
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:z2z62d3&fmt=3
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
0
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Protocol
H2
Server
34.196.240.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-240-226.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
beacon-n021-ash-prod.krxd.net
date
Tue, 20 Jun 2023 19:44:14 GMT
cache-control
private, no-cache, no-store
x-request-time
D=29 t=1687290254
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
date
Tue, 20 Jun 2023 19:44:14 GMT
x-cache-hits
0
x-age
0
content-length
0
x-cache
MISS
x-served-by
usermatch-a012-ash-prod.krxd.net
usermatch.gif
beacon.krxd.net/
Redirect Chain
  • https://insight.adsrvr.org/track/pxl/?adv=64gxdrp&ct=0:1ingnzv&fmt=3
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
Protocol
H2
Server
34.196.240.226 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-240-226.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
beacon-n029-ash-prod.krxd.net
date
Tue, 20 Jun 2023 19:44:14 GMT
cache-control
private, no-cache, no-store
x-request-time
D=32 t=1687290254
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
date
Tue, 20 Jun 2023 19:44:14 GMT
x-cache-hits
0
x-age
0
content-length
0
x-cache
MISS
x-served-by
usermatch-a007-ash-prod.krxd.net
sodar
pagead2.googlesyndication.com/getconfig/ 		14 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306140101&st=env
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ce37aa7f0bba919bfd53c5c9bf7628c73a5bf07d80bc14abc8c242753a655ab8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:14 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11093
x-xss-protection
0
syncframe
gum.criteo.com/ Frame 9C7F 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:13 GMT
server
Kestrel
server-processing-duration-in-ticks
538997
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
syncframe
gum.criteo.com/ Frame AD52 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:13 GMT
server
Kestrel
server-processing-duration-in-ticks
813154
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
vitals
www.foo.software/api/ 		0
95 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.foo.software/api/vitals
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
137.184.240.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.25.0 / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:14 GMT
server
nginx/1.25.0
x-powered-by
Express
track
dc.services.visualstudio.com/v2/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.71.13.169 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,sdk-context
Access-Control-Request-Method
POST
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-max-age
3600
content-length
0
date
Tue, 20 Jun 2023 19:44:13 GMT
x-content-type-options
nosniff
track
dc.services.visualstudio.com/v2/ 		98 B
306 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
40.71.13.169 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6cd3cf5f204d9c728f91590d92ce0fd61491617a06a9bbfd9928a6eed3e9088b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
999D17DC-D0C1-4FEC-8E82-47A7494D77C8
strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:14 GMT
x-content-type-options
nosniff
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length
98
555a9ba0-0500-491c-9191-295a6e510752
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/555a9ba0-0500-491c-9191-295a6e510752
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
usync.html
eus.rubiconproject.com/ Frame B2F9 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:14 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame A105 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:14 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:16 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame BBC5 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165940
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:14 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 2137 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da4be96a7f889837492287bae2ce3b85ff70c2ba8274bf0ee3c9c8b36f63aa97

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6815b08c24400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
server
cloudflare
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 2CA4
Redirect Chain
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
43 B
816 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=8681e833-58ee-4151-9960-f1e5bdda03d8&gdpr_consent=null&gdpr=0
date
Tue, 20 Jun 2023 19:44:14 GMT
server
_
content-length
0
v1
match.sharethrough.com/sync/ Frame 2CA4
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4614819635623485669&gdpr=0&gdpr_consent=
68 B
602 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4614819635623485669&gdpr=0&gdpr_consent=
Protocol
H2
Server
3.223.221.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-223-221-83.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:14 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

location
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4614819635623485669&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
redir
rtb-csync.smartadserver.com/ Frame 2CA4
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
43 B
816 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAD8LE7JJAMAAB-Q-u4sFQ&gdpr=0
Date
Tue, 20 Jun 2023 19:44:14 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
/
rtb-csync.smartadserver.com/redir/ Frame 2CA4
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=smartadserver&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=smartadserver&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=9196abb7-eff9-418f-8017-c9ef56d86182&ssp=smartadserver&expires=30&user_group=5&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6
  • https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=
43 B
816 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location
//rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=
Date
Tue, 20 Jun 2023 19:44:15 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
pixel
cm.g.doubleclick.net/ Frame 2CA4
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
Protocol
H3
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:13 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
b07d67d9-6518-4db8-80f1-b34dca1d1b04
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/b07d67d9-6518-4db8-80f1-b34dca1d1b04
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
vevent
nym1-ib.adnxs.com/ Frame 1309 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLUCvQXAVQFAAADANYABQEIhoPIpAYQh5Tx1pWkpJ0TGKGWrf2BkMCvECo2CdcbZmXxvJ4_EfVg_aBpN5c_GQAAAIDC9fA_IWVyeZLFFKE_KVq77UJznaY_MQAAACCF67E_MO7fwQ04mFBAmDlIAlDW563TAVi5q5cBYABopq60AXjGzwSAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNjAzODY4OCwgMCk7dWYoJ2knLCA3MzYxODkwLCAwKTt1ZignZycsIDE4Mjk2ODA0LCAwKTt1ZigncycsIDI3NTYxOTAwMCwgMCk7dWYoJ3InLCA0NDMyNDk2MjIFVfCLkgKhBCFBR19oYndqUXVMQVpFTmJucmRNQkdBQWd1YXVYQVRBQ09BQkFBRWlZT1ZEdTM4RU5XQUJnZ1Fab0FIQUFlQUNBQVFDSUFRQ1FBUUdZQVFHZ0FRcW9BUXF3QVFDNUFTT3htZWZzbktZX3dRRWpzWm5uN0p5bVA4a0JBQUFBQUFBQThEX1pBUUEJDnRQQV80QUhpcXNFRDlRRzhYYk05bUFJQW9BSUJ0UUkFJAB2DQjwaXdBSUF5QUlBMEFJQTJBSUE0QUlBNkFJQS1BSUFnQU1CbUFNQm9nTU9DSXl5dmlJUUN4Z0NMUUFBQUFDNkF3bE9XVTB5T2pVek5EWGdBLWxEZ0FUZl80NExpQVRBOE5rSWtBUUJtQVFCd1EFNQkBCE1rRQkJAQEYRFlCQUR4QgELDQF4aUFYaEtaZ0Z1TG0yZ3dHcEJkT2tGSFI3U2UwX3NRVQUmHDB3emxQOEVGBQ0cTk1NMVRfSkIBYxxPQzFDdEVfMA0oBQEETmsJKCko8EBnQmNFaThBWGszOXdJLUFXZ3lmQUNnZ1lEVlZORWlBWUVrQVlCbUFZQW9RYmItWDVxdkhUdlA2Z0dCTElHSkFrQQFIBQEAQh3HBEJrBRMFAQBDHRhETGdHQ2cuLpoCmQEhdlJieXRBOiUCZExtcmx3RWdBQ2dBTWR2NWZtcThkTzhfT2dsPV0UVkE2VU5KBV0FxQQ5UgEICQEEQloJCAEBBEJoAQYJAQRCcAkIAQEEQngBBgkBEEI0QUlrNXD0SAE4RDgu2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xNzioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQONzMyMCNOWU0yOjUzNDXaBAIIAeAEAfAE1uet0wGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWiiQf6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AGqSXaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgHxs8E0gcNCS4xABTaBwYIABABOmQHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=97885f2be7ebf0c375c11dab829b2e7e729d6e6f&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=7756278961844469817&vd=ct~0|rr~6&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&cid=3&cr=pv&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.161.182 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:14 GMT
AN-X-Request-Uuid
1a21922c-422a-4110-bae4-7ad79f85f0fe
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sid
mug.criteo.com/ Frame 9C7F
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=zcBsF19LTUhQb0J2ZFduR0tJWlp1Z24wJTJCRTRxM1ElMkZsVXVqMTNsTG4wbUN5...
  • https://mug.criteo.com/sid?cpp=NtS0h3w2NGliaFYyalpXWEI4TEFxVGRBR1RGL2x4YTg3eHc4SGNVTnUrQTNqSzdFejVubVMwbVQ3aEtPZklJSG5pcTB6dzdoSDc1QUxiQTQ3RG1jWkI0NkNIemxvditFRm8vTjdsQzdMYmVYbUJNeTdvakh2MWdiaGV0MX...
425 B
653 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=NtS0h3w2NGliaFYyalpXWEI4TEFxVGRBR1RGL2x4YTg3eHc4SGNVTnUrQTNqSzdFejVubVMwbVQ3aEtPZklJSG5pcTB6dzdoSDc1QUxiQTQ3RG1jWkI0NkNIemxvditFRm8vTjdsQzdMYmVYbUJNeTdvakh2MWdiaGV0MXlsZCtMeUdYSlNhL29yRkVzTGNZbE9BRURZc2poMUJVK25pQkIvbUVNb2hsTTJ3R205VUR3cWdkUTJucEhmamxObnRnM3V3ZGtZeS9ZTDlrWlgwMjQ1VlVsQlBUSUVSNHNUVWtHNnhhZ1A1UldqOXRGdkpjNkduS3ZmeUdabEJEM05odDF2RUFUU2Q3R0liUjN6SHpmMVFCNm1ZRmtyYUI5MGR1MWhrZnI2eXN3N2FibnhDST18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
2e6242b62f1ae154639748873e42455c907d129745c92fb5cb774e77ccc2e626
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
2296600
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:13 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=NtS0h3w2NGliaFYyalpXWEI4TEFxVGRBR1RGL2x4YTg3eHc4SGNVTnUrQTNqSzdFejVubVMwbVQ3aEtPZklJSG5pcTB6dzdoSDc1QUxiQTQ3RG1jWkI0NkNIemxvditFRm8vTjdsQzdMYmVYbUJNeTdvakh2MWdiaGV0MXlsZCtMeUdYSlNhL29yRkVzTGNZbE9BRURZc2poMUJVK25pQkIvbUVNb2hsTTJ3R205VUR3cWdkUTJucEhmamxObnRnM3V3ZGtZeS9ZTDlrWlgwMjQ1VlVsQlBUSUVSNHNUVWtHNnhhZ1A1UldqOXRGdkpjNkduS3ZmeUdabEJEM05odDF2RUFUU2Q3R0liUjN6SHpmMVFCNm1ZRmtyYUI5MGR1MWhrZnI2eXN3N2FibnhDST18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
245652
content-length
0
expires
0
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:44:14 GMT
sid
mug.criteo.com/ Frame AD52
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=zcBsF19LTUhQb0J2ZFduR0tJWlp1Z24wJTJCRTRxM1ElMkZsVXVqMTNsTG4wbUN5...
  • https://mug.criteo.com/sid?cpp=jdlKbnxZeGplWHJ0Ty9FYTBzem9KOC9oMkx1ZGh5eVhxTHhVYk91MkZCOXdLK3MySTdaUC9EbExmRGNPMkVVaGFjRXNOTm4yQzZZYXFNWDZLaHVJZ2VKbExKR1lTVlU1UFpVVllHYmRaQnd1OFUrTFJTakJqRHNiTHZ2Wm...
417 B
649 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=jdlKbnxZeGplWHJ0Ty9FYTBzem9KOC9oMkx1ZGh5eVhxTHhVYk91MkZCOXdLK3MySTdaUC9EbExmRGNPMkVVaGFjRXNOTm4yQzZZYXFNWDZLaHVJZ2VKbExKR1lTVlU1UFpVVllHYmRaQnd1OFUrTFJTakJqRHNiTHZ2WmJSam40MzNlMmJZWXhSYytnUG5wRFFhb3dWTmpwWGhtci91elI3OHNpczM3TnYyK2syU2VpOVFQa2V0Yno2WkVURkVCUjBvSFF5THV2UWlrSGgwMU4wZkdjdzN6RjVrMnRmK0ttUFJOT3Qzd0xvWWRhS3YrbmNaeDlObjMzOHpGRnoyY1YzL0toS0ZxYXExL2VqeVB6SUFiTSt0SFQyVzRVTFBzZXNpZHd4emYvdVVKenhEcz18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
ea25658103c080ba576e704ef1f3d174a8cb48b9dba8d447f110778fcc5ead0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1372043
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=jdlKbnxZeGplWHJ0Ty9FYTBzem9KOC9oMkx1ZGh5eVhxTHhVYk91MkZCOXdLK3MySTdaUC9EbExmRGNPMkVVaGFjRXNOTm4yQzZZYXFNWDZLaHVJZ2VKbExKR1lTVlU1UFpVVllHYmRaQnd1OFUrTFJTakJqRHNiTHZ2WmJSam40MzNlMmJZWXhSYytnUG5wRFFhb3dWTmpwWGhtci91elI3OHNpczM3TnYyK2syU2VpOVFQa2V0Yno2WkVURkVCUjBvSFF5THV2UWlrSGgwMU4wZkdjdzN6RjVrMnRmK0ttUFJOT3Qzd0xvWWRhS3YrbmNaeDlObjMzOHpGRnoyY1YzL0toS0ZxYXExL2VqeVB6SUFiTSt0SFQyVzRVTFBzZXNpZHd4emYvdVVKenhEcz18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
330142
content-length
0
expires
0
usync.js
eus.rubiconproject.com/ Frame B2F9 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:14 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 03:39:20 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=28506
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 03:39:20 GMT
375497417216748
connect.facebook.net/signals/config/ 		376 KB
107 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/375497417216748?v=2.9.107&r=stable
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
51b9c4f1aa6c3e60906e6dad687a22e11aa9f5e517d748eafcba598b1a683b30
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:44:14 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
109843
x-xss-protection
0
pragma
public
x-fb-debug
N2gR9A3+FBtQuS8TD+gGIUuYA1KkrLmRR4mvsiEKKPaZ1/Zg/4yCC4sKbJjU0qxVzxy6NmcV1U2wh+gv1SVAZA==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/ 		0
185 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1060502780777063&ev=PageView&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687290254668&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1687290254663.394908289&cs_est=true&it=1687290243034&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:44:14 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.facebook.com/tr/ 		0
31 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=614620065398091&ev=PageView&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687290254672&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1687290254663.394908289&it=1687290243034&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:44:14 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
25052057.js
bat.bing.com/p/action/ 		0
118 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/25052057.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Tue, 20 Jun 2023 19:44:14 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: C071C4E8AA4F46DF980AE800A42CE730 Ref B: YMQ01EDGE0414 Ref C: 2023-06-20T19:44:14Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/ 		0
361 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=25052057&Ver=2&mid=9e065401-0b67-40cd-b3dc-043d111a5aee&sid=d639d7d00fa211ee9038392b1d067fe6&vid=d63a30a00fa211eebec3330b972ab9e6&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&p=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&r=&lt=15407&evt=pageLoad&sv=1&rn=482273
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:44:14 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 04B89254A4E049B1A02B0E70FF51E0FC Ref B: YMQ01EDGE0414 Ref C: 2023-06-20T19:44:14Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame 8192 		573 B
889 B 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=85888649&p=156383&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
d19ef88f5f15554d56524ecb3374654b73335e910648b501d45c845d668d8f28

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Tue, 20 Jun 2023 07:30:26 GMT
content-length
573
content-type
text/html; charset=UTF-8
PugMaster
image6.pubmatic.com/AdServer/ Frame 7F5E 		637 B
906 B 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=47005955&p=156383&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
d99139d14823693f61e51a58956ed62e81bb5cd72abb48118a131bacd1f5055e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Tue, 20 Jun 2023 19:44:13 GMT
content-length
637
content-type
text/html; charset=UTF-8
cs.js
sb.scorecardresearch.com/internal-c2/default/
Redirect Chain
  • https://sb.scorecardresearch.com/c2/6035443/cs.js
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
0
358 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/internal-c2/default/cs.js
Protocol
H2
Server
13.35.93.31 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-31.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:36:29 GMT
via
1.1 827e4274db61b1bc4aa840491aa652a0.cloudfront.net (CloudFront)
last-modified
Mon, 01 Mar 2021 20:42:20 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P8
age
467
x-amz-server-side-encryption
AES256
etag
"d41d8cd98f00b204e9800998ecf8427e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
0
x-amz-cf-id
r7D6xD7rdCv_3d_iq7TaBhyAiODXbHkYOILCc-qoYfXjoX3Pw3mmrQ==

Redirect headers

date
Tue, 20 Jun 2023 19:44:15 GMT
via
1.1 827e4274db61b1bc4aa840491aa652a0.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P8
x-cache
Miss from cloudfront
location
/internal-c2/default/cs.js
content-length
0
x-amz-cf-id
vYnFm63jVdh9WQJXVkN_MFmTwgjPGYxaVNfFgMvbLOhfw_DS6sEE7g==
6df83417-1a0d-4ee3-bf4f-e9616180eb90
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/6df83417-1a0d-4ee3-bf4f-e9616180eb90
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9898 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
46544
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 06:48:31 GMT
expires
Wed, 19 Jun 2024 06:48:31 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 2EB7 		783 B
538 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
df0ef2e0d44b640bbb8329f32a6d04508050e23933a59c9e5c59f76c2da85bd8
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-Xzq3j9GaE-XzI5xRZPiYZA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
516
content-security-policy
script-src 'report-sample' 'nonce-Xzq3j9GaE-XzI5xRZPiYZA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:15 GMT
expires
Tue, 20 Jun 2023 19:44:15 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
async_usersync
ib.adnxs.com/ Frame A105 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:15 GMT
AN-X-Request-Uuid
eb36b700-f4a1-462f-a647-9dc2d6b084ed
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 2137 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152220
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da6815ecd5c4400-EWR
expires
Thu, 31 Dec 2037 23:55:55 GMT
/
www.facebook.com/tr/ 		0
54 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=375497417216748&ev=PageView&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687290255149&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1687290254663.394908289&cs_est=true&it=1687290243034&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:44:15 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.facebook.com/tr/ 		0
31 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=375497417216748&ev=ViewContent&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687290255153&sw=1600&sh=1200&v=2.9.107&r=stable&ec=1&o=30&fbp=fb.1.1687290254663.394908289&it=1687290243034&coo=false&tm=1&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:44:15 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
75145
i.liadm.com/s/ Frame 8192 		43 B
633 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.169.137.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-169-137-149.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:15 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
2
Content-Type
image/gif
qmap
sync.crwdcntrl.net/ Frame 8192 		49 B
264 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.20.148.40 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-20-148-40.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.13.77
content-length
49
expires
0
/
io.narrative.io/ Frame 8192
Redirect Chain
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:8E87CD5E-E863-49F4-8101-49E63E3D4BD9
  • https://io.narrative.io/?io.narrative.guid.v2=d68568d0-0fa2-11ee-b479-0e71178f036d&companyId=673&id=pubmatic_id:8E87CD5E-E863-49F4-8101-49E63E3D4BD9
0
247 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://io.narrative.io/?io.narrative.guid.v2=d68568d0-0fa2-11ee-b479-0e71178f036d&companyId=673&id=pubmatic_id:8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Protocol
HTTP/1.1
Server
54.205.176.242 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-205-176-242.compute-1.amazonaws.com
Software
nginx/1.22.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:15 GMT
Cache-Control
no-cache
Server
nginx/1.22.1
Connection
keep-alive

Redirect headers

Location
https://io.narrative.io/?io.narrative.guid.v2=d68568d0-0fa2-11ee-b479-0e71178f036d&companyId=673&id=pubmatic_id:8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Date
Tue, 20 Jun 2023 19:44:15 GMT
Server
nginx/1.22.1
Connection
keep-alive
Content-Length
0
p
a.audrte.com/ Frame 8192
Redirect Chain
  • https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
  • https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=ZzI3RE5ydUpjVC1TdnFMd0cxTmpFZy15UQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL...
  • https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
  • https://a.audrte.com/a?adform_uid=1598040676591792150&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D
  • https://a.audrte.com/p
68 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.audrte.com/p
Protocol
HTTP/1.1
Server
3.221.8.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-8-21.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:15 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
68

Redirect headers

Date
Tue, 20 Jun 2023 19:44:15 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Access-Control-Allow-Origin
*
Location
https://a.audrte.com:443/p
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
match
c1.adform.net/serving/cookie/ Frame BFB0 		35 B
591 B 		Document
General
Check archive.org
Download Go to
Full URL
https://c1.adform.net/serving/cookie/match?party=14&cid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.167.164.49 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, no-transform
content-type
image/gif
date
Tue, 20 Jun 2023 19:44:15 GMT
expires
-1
pragma
no-cache
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
g.pixel
aa.agkn.com/adscores/ Frame 7F5E 		43 B
654 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212308278&puid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.90 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-90.ewr50.r.cloudfront.net
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
via
1.1 724c8c129f28bfce25c0430050f1ae72.cloudfront.net (CloudFront)
server
AAWebServer
x-amz-cf-pop
EWR50-C1
access-control-allow-methods
GET, POST, OPTIONS
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
x-cache
Miss from cloudfront
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length
43
x-amz-cf-id
ICtagkjpKAEg2vB08lju5HbVm8F5mNTAhxhTv_blBfLPlcISdmlKEA==
expires
0
info
uipglob.semasio.net/pubmatic/1/ Frame 7F5E 		42 B
603 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://uipglob.semasio.net/pubmatic/1/info?sType=sync&sExtCookieId=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&sInitiator=external&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.57.31.206 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software
/
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:15 GMT
Frontend-ID
7
P3P
policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Content-Type
image/gif
UIP-Response-Status
Ok
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Origin
*
Content-Length
42
Routing-Server-ID
-1
Expires
Sat, 01 Jan 2011 12:00:00 GMT
generic
match.adsrvr.org/track/cmf/ Frame 7F5E
Redirect Chain
  • https://pixel.onaudience.com/?partner=214&mapped=8E87CD5E-E863-49F4-8101-49E63E3D4BD9&gdpr=0&gdpr_consent=
  • https://loada.exelator.com/load/?p=1164&g=1&j=r&gdpr=0&ru=https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D161%26icm%26cver%26mapped%3D%25%25UID%25%25%26gdpr%3D0
  • https://pixel.onaudience.com/?partner=161&icm&cver&mapped=ccefd08a7a2dee4d7fe9c6bf481a14a8&gdpr=0
  • https://sync.crwdcntrl.net/map/c=8587/tp=CLOD/tpid=d2a6ca27ac73d20d/gdpr=0/gdpr_consent=?https%3A%2F%2Fpixel.onaudience.com%2F%3Fpartner%3D104%26icm%26cver%26mapped%3D%24%7Bprofile_id%7D%26gdpr%3D%...
  • https://pixel.onaudience.com/?partner=104&icm&cver&mapped=a433a0635e30a7fd76ec22a26382a12&gdpr=0
  • https://pixel.onaudience.com/?partner=109&icm&cver&gdpr=0&smartmap=1&redirect=tags.bluekai.com%2Fsite%2F33141%3F%26id%3D%25m
  • https://tags.bluekai.com/site/33141?&id=1327fde4d7fe8871
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
70 B
700 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
Protocol
H2
Server
3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

location
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
date
Tue, 20 Jun 2023 19:44:16 GMT
content-length
0
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/747356055/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/747356055/?random=1687290254911&cv=11&fst=1687290254911&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=1333905033.1687290241&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
234ad8ca5417a1cac554e51d21aacf43a8dee208eb8b42740f5fab2ad015047f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1438
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ Frame 519D 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.mercurynews.com
Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.mercurynews.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:15 GMT
priority
u=0,i
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
/
www.facebook.com/tr/ Frame B0F1 		0
15 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.mercurynews.com
Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.mercurynews.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:15 GMT
priority
u=0,i
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
sodar
pagead2.googlesyndication.com/pagead/ Frame 2EB7 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306140101&jk=3515810653216537&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
drop_cookie_sw.php
csync.smilewanted.com/ Frame D2A4 		0
654 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681600f054400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 9898 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 16 Jun 2023 14:56:57 GMT
content-encoding
br
x-content-type-options
nosniff
age
362838
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 15 Jun 2024 14:56:57 GMT
f6146743-46db-4d85-a9f2-1zz1687290251
csync.smilewanted.com/set_partner_userid_get/richaudience/ Frame A589
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
0
670 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68160bfd94400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:13 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
server
nginx
x-powered-by
PHP/8.2.4
/
www.google.com/pagead/1p-user-list/747356055/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/747356055/?random=1687290254911&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2793054136&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/747356055/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/747356055/?random=1687290254911&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2793054136&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:807::2003 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
2f81eaed-0776-53ab-ae15-6ab4ca876b38
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame CEAB
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
0
654 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68160bfd84400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
1598040676591792150
csync.smilewanted.com/set_partner_userid_get/adform/ Frame A06E
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
0
648 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68161788a4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:15 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
server
nginx
973f48b68d39913ead7b63a7ed88bc5
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame B4A1
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/973f48b68d39913ead7b63a7ed88bc5?gdpr_consent=&gdpr=0
0
759 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/973f48b68d39913ead7b63a7ed88bc5?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6816198b64400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:15 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/973f48b68d39913ead7b63a7ed88bc5?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290255557044-254
/
csync.smilewanted.com/ Frame A381 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da4be96a7f889837492287bae2ce3b85ff70c2ba8274bf0ee3c9c8b36f63aa97

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6816148664400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame CBB3 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:15 GMT
ETag
"403b9-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 8ED0 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165939
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:15 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 7BCA 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:15 GMT
ETag
"623de86a-cf34"
Expires
Wed, 21 Jun 2023 19:44:17 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 9BD7
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc...
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
43 B
846 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEMCO8RRcAPIm0NK8XFQn0YM&gdpr=0&gdpr_consent=&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame 9BD7
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1598040676591792150&gdpr=0&gdpr_consent=
43 B
816 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1598040676591792150&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=1598040676591792150&gdpr=0&gdpr_consent=
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame 9BD7
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
Protocol
H3
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:15 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDYxNDgxOTYzNTYyMzQ4NTY2OQ==&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:14 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
p
a.audrte.com/ Frame 9BD7
Redirect Chain
  • https://a.audrte.com/get?p=M501991648&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D141%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=141&partneruserid=g27DNruJcT-SvqLwG1NjEg-yQ&gdpr=0&gdpr_consent=&redirurl=https%3A%2F%2Fa.audrte.com%2Fmatch%3Fuid%3DSMART_USER_ID%26p%3D...
  • https://a.audrte.com/match?uid=4614819635623485669&p=M501991648&r=https%3A%2F%2Fa.audrte.com%2Fp%3F&gdpr=0&gdpr_consent=
  • https://a.audrte.com/p?
68 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.audrte.com/p?
Protocol
HTTP/1.1
Server
3.221.8.21 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-221-8-21.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:15 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
68

Redirect headers

Date
Tue, 20 Jun 2023 19:44:15 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Access-Control-Allow-Origin
*
Location
https://a.audrte.com/p?
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
711890.gif
id.rlcdn.com/ Frame 9BD7 		42 B
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id.rlcdn.com/711890.gif?credir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D136%26partneruserid%3D&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:15 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 8620
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
0
773 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6816198b74400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:15 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
setuid
ib.adnxs.com/prebid/ Frame 663E
Redirect Chain
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%...
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
43 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

AN-X-Request-Uuid
7feabc8e-4a0a-4ad4-a6b9-79cf1b07e6c4
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:15 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68161a8c74400-EWR
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
location
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
server
cloudflare
generate_204
tpc.googlesyndication.com/ Frame 9898 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?w0IqIQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:809::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:15 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
usync.js
eus.rubiconproject.com/ Frame CBB3 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.91.103.236 Boston, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-91-103-236.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:15 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 03:39:20 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=28505
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 03:39:20 GMT
connectmyusers.php
cdn.connectad.io/ Frame B36E 		1 KB
855 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
851
alt-svc
h3=":443"; ma=86400
cache-control
max-age=3600
cf-cache-status
HIT
cf-ray
7da68162aa789e05-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
last-modified
Tue, 20 Jun 2023 19:30:04 GMT
server
cloudflare
vary
Accept-Encoding
4614819635623485669
csync.smilewanted.com/set_partner_userid_get/smart/ Frame 77E2
Redirect Chain
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]
  • https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
0
952 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6816299ea4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:15 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
/
www.facebook.com/tr/ Frame DBE7 		0
15 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.mercurynews.com
Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.mercurynews.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:15 GMT
priority
u=0,i
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
csync.smilewanted.com/set_partner_userid_get/improve/ Frame E841
Redirect Chain
  • https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010
  • https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
0
783 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68162fa8f4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

access-control-allow-origin
*
content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:15 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame A381 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:15 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152220
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da68162da604400-EWR
expires
Thu, 31 Dec 2037 23:55:55 GMT
LJ4P1MPG-1E-GIGU
csync.smilewanted.com/set_partner_userid_get/rubicon/ Frame 44EA
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
0
724 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681634af54400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma
no-cache
X-RPHost
8bab65602db075726861004da5629947
content-length
0
async_usersync
ib.adnxs.com/ Frame 7BCA 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:15 GMT
AN-X-Request-Uuid
4ad21b9b-2ee3-4a65-a48f-724fc170e1b4
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
drop_cookie_sw.php
csync.smilewanted.com/ Frame AEB2 		0
759 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681634af34400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:15 GMT
server
cloudflare
vary
Accept-Encoding
f6146743-46db-4d85-a9f2-1zz1687290251
csync.smilewanted.com/set_partner_userid_get/richaudience/ Frame CC54
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
0
724 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681641be54400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:14 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/richaudience/f6146743-46db-4d85-a9f2-1zz1687290251
server
nginx
x-powered-by
PHP/8.2.4
1
sync-eu.connectad.io/syncer/ Frame 9946 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Requested by
Host: cdn.connectad.io
URL: https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cce63ff3511f00d546e736ef2d31a8366ec9dfbfff2eaaf91c1ca0d214024ca2

Request headers

Referer
https://cdn.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da68163bbab9e05-EWR
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:16 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
server
cloudflare
vary
Accept-Encoding
2f81eaed-0776-53ab-ae15-6ab4ca876b38
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 7A62
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
0
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68163dba24400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/2f81eaed-0776-53ab-ae15-6ab4ca876b38
1598040676591792150
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 6A5E
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
0
867 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68164ac964400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:16 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1598040676591792150
server
nginx
da3024658895bd5e79dc0b645ffc08
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame A58D
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/da3024658895bd5e79dc0b645ffc08?gdpr_consent=&gdpr=0
0
805 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/da3024658895bd5e79dc0b645ffc08?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68164ac954400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:16 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/da3024658895bd5e79dc0b645ffc08?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290256043074-276
d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 7467
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
0
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68164ccb24400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:16 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/d9d57ae33908f51e4f95811de023aa7972aa658b56bf2ab3c408c00a82fe1c7b
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
usermatch
ssum.casalemedia.com/ Frame 51A7 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
f05d3a37fe8746b17c50681d854a40f43fffb5d5ef7d72d8a494e7498daeda23

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
1603
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:16 GMT
Expires
0
Keep-Alive
timeout=1, max=500
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
setuid
ib.adnxs.com/prebid/ Frame 82DF
Redirect Chain
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%...
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
43 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.113 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

AN-X-Request-Uuid
2ce6d9fb-3f04-462b-b48b-99453ecd7563
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:16 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68164fd084400-EWR
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
location
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=7da4bf8d51312ee08f5dbf93cfbcb0b9
server
cloudflare
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 0433 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165938
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:16 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy
csync.smilewanted.com/set_partner_userid_get/connectad/ Frame 9ACA 		0
831 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/connectad/VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681653d5b4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding
1
sync.connectad.io/umatch/ Frame EF3F
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dadform%26dataid%3Ddata4%26uuid%3D%24UID
  • https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da681663e789e05-EWR
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:16 GMT
location
https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
server
nginx
1
sync-eu.connectad.io/pixel/ Frame 3444
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=rtaplus&user_id=VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy&gdpr=0
  • https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=b906d225-1d58-4500-8893-66f3b5de01e6&ssp=rtaplus&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=419&user_id=10599714307805270596&ssp=rtaplus&gdpr=0&gdpr_consent=
  • https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da68166bf0122ee-ORD
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:16 GMT
Location
//sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Server
nginx
1
sync.connectad.io/umatch/ Frame C56D
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dsovrn%26dataid%3Ddata12%26uuid%3D%24UID
  • https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da681663e769e05-EWR
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:16 GMT
Location
https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
X-Sovrn-Pod
ad_ap1dca1
cm
u.openx.net/w/1.0/ Frame EBC1 		850 B
547 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
1cc1846f9b84179d7a072de956b23ab2732f8d0d1f88ddc193f446febd1913e8

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
528
content-type
text/html
date
Tue, 20 Jun 2023 19:44:16 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
via
1.1 google
1
sync.connectad.io/umatch/ Frame 6882
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=connectad
  • https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da681663e759e05-EWR
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:16 GMT Tue, 20 Jun 2023 19:44:16 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
pragma
no-cache
connectmyusers.php
cdn.connectad.io/ Frame 277A 		1 KB
710 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
852
alt-svc
h3=":443"; ma=86400
cache-control
max-age=3600
cf-cache-status
HIT
cf-ray
7da681656d999e05-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
last-modified
Tue, 20 Jun 2023 19:30:04 GMT
server
cloudflare
vary
Accept-Encoding
4614819635623485669
csync.smilewanted.com/set_partner_userid_get/smart/ Frame B847
Redirect Chain
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]
  • https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
0
835 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da681662e8b4400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:15 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/smart/4614819635623485669
ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 51A7 		43 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:b5c0:eead:85e9:361a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 51A7
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZJIBgknqWgpSPnqrMo17egAADtAAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
  • https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
43 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
H2
Server
2600:1f18:4e9:5a07:b5c0:eead:85e9:361a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43

Redirect headers

location
https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
crum
dsum-sec.casalemedia.com/ Frame 51A7
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=c0d66492-0183-4f00-930f-e67415c7188d
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=c0d66492-0183-4f00-930f-e67415c7188d
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
MT3 1031 59fd23a master iad iad-pixel-x22 config_version:"1969"
Content-Type
image/gif
Access-Control-Allow-Origin
*
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=c0d66492-0183-4f00-930f-e67415c7188d
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 20 Jun 2023 19:44:15 GMT
crum
dsum-sec.casalemedia.com/ Frame 51A7
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/ie
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAD8LE7JJAMAAB-Q-u4sFQ&expiration=1688499856
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAD8LE7JJAMAAB-Q-u4sFQ&expiration=1688499856
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAD8LE7JJAMAAB-Q-u4sFQ&expiration=1688499856
Date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
crum
dsum.casalemedia.com/ Frame 51A7
Redirect Chain
  • https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID
  • https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=1179662177681492769
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=1179662177681492769
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

Date
Tue, 20 Jun 2023 19:44:16 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
6e45d01f-6e11-42ee-8732-fbae857d9284
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=1179662177681492769
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 51A7
Redirect Chain
  • https://b1sync.zemanta.com/usersync/index/?us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
  • https://stags.bluekai.com/site/23178?id=7dYANMJyrp6NSRwK_hfM&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3S...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS6ZDTOVWS243FMMXGGYLTMFWGK3LFMRUWCLTDN5WS6Y3SOVWT6Y3NL5SHG4C7NFSD2MJXEZSXQY3IMFXGOZJ5NFXGIZLYEZSXQ5DFOJXGC3C7OVZWK4S7NFSD2N3ELFAU4...
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=7dYANMJyrp6NSRwK_hfM
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=7dYANMJyrp6NSRwK_hfM
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=498
Content-Length
43
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Content-Type
text/html; charset=utf-8
Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=17&external_user_id=7dYANMJyrp6NSRwK_hfM
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
115
Expires
Thu, 01 Dec 1994 16:00:00 GMT
rum
dsum.casalemedia.com/ Frame 51A7
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=index
  • https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dindex
  • https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dindex
  • https://x.bidswitch.net/sync?dsp_id=59&user_id=620af48c-687b-4acd-b194-f908d727b4e1&ssp=index
  • https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

Location
//dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
Date
Tue, 20 Jun 2023 19:44:16 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
rum
dsum-sec.casalemedia.com/ Frame 51A7
Redirect Chain
  • https://ad.turn.com/r/cs?pid=21
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8301830339311477822
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8301830339311477822
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8301830339311477822
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
1
sync.connectad.io/umatch/ Frame 51A7 		0
510 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.connectad.io/umatch/1?bidder=idx&dataid=data13&uuid=ZJIBgknqWgpSPnqrMo17egAA%263792
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7da681668ed49e05-EWR
alt-svc
h3=":443"; ma=86400
1
sync.connectad.io/umatch/ Frame EBC1 		0
507 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.connectad.io/umatch/1?dataid=data5&uuid=0557d8e0-6f29-46d6-b42c-86d2012decc5
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7da681663e799e05-EWR
alt-svc
h3=":443"; ma=86400
sd
us-u.openx.net/w/1.0/ Frame EBC1
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJIBgwATV5hRfwBa
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJIBgwATV5hRfwBa
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by
cache-yul12831-YUL
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687290256.327099,VS0,VE0
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJIBgwATV5hRfwBa
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
a84e316b-461a-e776-ee77-50327f21e301
pr-bh.ybp.yahoo.com/sync/openx/ Frame EBC1 		43 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/a84e316b-461a-e776-ee77-50327f21e301?gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:b5c0:eead:85e9:361a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
dcm
s.amazon-adsystem.com/ Frame EBC1 		43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=645f2b52-ca1c-cec5-1fae-c450e845e5a8
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
44M9EZ236SRC6KQXCSPJ
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
generic
match.adsrvr.org/track/cmf/ Frame EBC1
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=3c89572f-d6b6-753f-dfa0-46c780762e48&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=NTlmMTdjMDYtYzVkMi00YjFlLTg5YWEtM2Q2NGZmMDkxMDIy&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64f...
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022&google_gid=CAESEPmdpgORtQ_COK5_UXRIfeE&google_cver=1
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=1179662177681492769&ttd_tdid=59f17c06-c5d2-4b1e-89aa-3d64ff091022
  • https://tags.bluekai.com/site/5386?id=59f17c06-c5d2-4b1e-89aa-3d64ff091022&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
70 B
700 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H2
Server
3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

location
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
date
Tue, 20 Jun 2023 19:44:16 GMT
content-length
0
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
pixel
cm.g.doubleclick.net/ Frame EBC1 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTBlNjg0ZTUtMWZjMS0yYjliLWNhNDAtMWM3ZTRhOTRlMDI4
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame EBC1
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEN4T7m2w3pvZfNlg8evq3kE&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEN4T7m2w3pvZfNlg8evq3kE&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEN4T7m2w3pvZfNlg8evq3kE&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
csync.smilewanted.com/set_partner_userid_get/improve/ Frame 6E3D
Redirect Chain
  • https://ice.360yield.com/server_match?r=https://csync.smilewanted.com/set_partner_userid_get/improve/{PUB_USER_ID}&partner_id=1010
  • https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
0
883 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68166af414400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

access-control-allow-origin
*
content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:16 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/improve/5adef92e-e872-4286-a590-6f8c8cb526ab&partner_id=1010
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 6EC3 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:16 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 2CA4 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:16 GMT
LJ4P1MPG-1E-GIGU
csync.smilewanted.com/set_partner_userid_get/rubicon/ Frame 3ECE
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-smilewanted&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
0
305 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68166cf604400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/rubicon/LJ4P1MPG-1E-GIGU?gdpr=0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Pragma
no-cache
X-RPHost
0b388c490ecfef74be7d13328a4f3ac3
content-length
0
1
sync.connectad.io/umatch/ Frame E291 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?dataid=data1&uuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da68166aef79e05-EWR
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
1
sync-eu.connectad.io/syncer/ Frame EB8E 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Requested by
Host: cdn.connectad.io
URL: https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f0acd22b0d5382be314a26f1b77ec2b0842c205abe480dc0c8c2d67342a23a1

Request headers

Referer
https://cdn.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da68166cf2122ee-ORD
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:16 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
server
cloudflare
vary
Accept-Encoding
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306140101&jk=3515810653216537&bg=!1dal1oLNAAaGYqkwpmI7ADkAdvg8Wg6Nln3TFfJXD2-fRVit9Q8bhfDeV7D2bo1tq1BR7LVWxbOIYk2UgUx8cTzIxs4ek4NO4C0CAAABTVIAAAAFaAEHmQLZAFnp9rAhsZOpFDMBdYZ5FPu26AlymCED7ZbDnF2CJOV7VDb5gxTjF5C1TzEse1l90O-vZFqlSdoHQCzoLFiN0FwuevJqpPODu-Id0T3IWPJleaL7SyuRCUdcgLdSKDpvGg6QMLIGZlDVsxqCEOUjScLIhroYdSO94RdexmbAhqkow10S5SkTXabpjvnof_BCthYPR7V_UYufiFVoBN-Tucbyjnt7B279-oX1kPgfWW7ked61gFB1uZNQsJOHFEYRK60OtBcRRV1bR402o3quFhEW-Aq8KszyUwV0BFZoPHHQYwvnV8OIby9G4vnC1usuR3W8d0j13wcGWtK7eCSQ7wRlAOTzNeU9uNZGIbPayCeZ-UuJ2zhwsAbQF_gZGkhV6ESYX8byMosXN-G2gYDrO47xBLt-hZTSlQXU5I6hLTLujgARMeP_tpLPNAHBjl41iHRvsMoPlue0tQnr2th-THkCGCPpelCs_0DMyFnnSLVuTcUMSaj0MP2LudQTZYVI1lOwy0PmntqUJyF5OA3agF6qHhc_OeNDFfhY220CukFgRBiRaI_s7EtUA5LQXu02oApHqY4fJaUdHSEMvHJUpVTjtplWGvBUJUPOm4aDfAkR-xP0kAj2RLB5IMKRo0g-jYwUKY46GMbUMBT25PXDDeLDyZKrtrQW4__Ehm_n79VyXcsaf6SOil6hg2IYSXSj2g6VPFpHU1I8lsBNQOFohaXnhTVKwGWxt1HwpfAUKARKsDeR9UG91JR43CSYY_fDRlPKzWgZuLVSitI-Ztv2CDnM4sntWHZQXE_FCpv31DimGfim7IYTE-AuL8PBpZshrI_iiIFS0ubYPeUt2u7ef4v3NKprYIOka5tnfuIeNV-2_m6PIhwwFEeUU3ZgF3sZpsc14FFFPWT47FCBHko2pNUWuxriIZDN4ambOf74iB3I3qXyUhJBWPuGb73vgjBjIvP0So9dIjqf
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4020:806::2002 Montreal, Canada, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
syncframe
gum.criteo.com/ Frame E94B 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:16 GMT
server
Kestrel
server-processing-duration-in-ticks
691141
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 2CA4 		88 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:16 GMT
syncframe
gum.criteo.com/ Frame 920D 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:16 GMT
server
Kestrel
server-processing-duration-in-ticks
672281
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 6EC3 		88 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:16 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame F8A7 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:16 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 8D4D 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:16 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 9BD7 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:16 GMT
sid
mug.criteo.com/ Frame E94B
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=FjHRA3xFcUY4VGNwT1ZTNC84K0JRRXlNSVpTZDhGZG1vUktWZ0lNSEpwQkFZd09rMHlwOW1BZU5Pb0IvMnBETVRGMk1ySEFWOGRTZVNZcFhleis1eUZNd3RtblYzbEVjbUhTQTBsNUF6V2tpdVZOc2hTMnRpTmNrM05TMl...
443 B
656 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=FjHRA3xFcUY4VGNwT1ZTNC84K0JRRXlNSVpTZDhGZG1vUktWZ0lNSEpwQkFZd09rMHlwOW1BZU5Pb0IvMnBETVRGMk1ySEFWOGRTZVNZcFhleis1eUZNd3RtblYzbEVjbUhTQTBsNUF6V2tpdVZOc2hTMnRpTmNrM05TMlEwWVVKbWM0UTdOb2hmZUN3STJDL2dFWFhPR09IaUttWlFwVklxUmY0R3A4N3R5c3loUi9jN1Y4Y2x6Z08rWmYwUzRNWHN5QXZWbHRSWElHbHRNVEtBbU9uZUhFcXluVFFoSGYvanhlVXVPZU9XWFJ5MVJObDlud0EzUFo4SjdKUHJiOXp2WVBDZ1RUSU5aUVNoR0N6OUZCdkc4NTczeUkxaVFMUURaVWlhK21Yb0JHL3kwMD18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
266185038ddc6adec0aa3b7705ff4f4ee91686273b22ed59fb4b466dc4625dbb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1229977
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=FjHRA3xFcUY4VGNwT1ZTNC84K0JRRXlNSVpTZDhGZG1vUktWZ0lNSEpwQkFZd09rMHlwOW1BZU5Pb0IvMnBETVRGMk1ySEFWOGRTZVNZcFhleis1eUZNd3RtblYzbEVjbUhTQTBsNUF6V2tpdVZOc2hTMnRpTmNrM05TMlEwWVVKbWM0UTdOb2hmZUN3STJDL2dFWFhPR09IaUttWlFwVklxUmY0R3A4N3R5c3loUi9jN1Y4Y2x6Z08rWmYwUzRNWHN5QXZWbHRSWElHbHRNVEtBbU9uZUhFcXluVFFoSGYvanhlVXVPZU9XWFJ5MVJObDlud0EzUFo4SjdKUHJiOXp2WVBDZ1RUSU5aUVNoR0N6OUZCdkc4NTczeUkxaVFMUURaVWlhK21Yb0JHL3kwMD18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
554077
content-length
0
expires
0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame A7DE 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165938
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:16 GMT
expires
Thu, 22 Jun 2023 17:49:54 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
usermatch
ssum.casalemedia.com/ Frame F6AC 		1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
d2994bd7f1adf7962df276de646190f2bd9d625c47ddec7711eed7ea82fb8273

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
1530
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:16 GMT
Expires
0
Keep-Alive
timeout=1, max=499
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
sid
mug.criteo.com/ Frame 920D
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=iec2lHxTNnROeFhDcTNveWloNzZQZGNMb2NvLzlPMEtxNXJreXB1eVZGbnBQVW8zVC9tZndpejlTSHliS2xXa2ZuQTJCYWxzOStEMXY0UEZ3TVk0NTZ5aGRhOXZIYkUxOHYzOHV2QUxrN0VxZm44RjB3dGxGSnE5UzJ3OW...
425 B
648 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=iec2lHxTNnROeFhDcTNveWloNzZQZGNMb2NvLzlPMEtxNXJreXB1eVZGbnBQVW8zVC9tZndpejlTSHliS2xXa2ZuQTJCYWxzOStEMXY0UEZ3TVk0NTZ5aGRhOXZIYkUxOHYzOHV2QUxrN0VxZm44RjB3dGxGSnE5UzJ3OW81VFlSSWZDMStUY3B1b1NJWG9WbUtJVlhzSjY5VzVIaG5nVnEzeG1LQWwxem1RaytJZ3FUTEV3T2ZZY2NhS205NjltQ0VIMWtDTXpDakU2RUZJVzlDekNlRTc0WEdQRzI4T2RSbDlxcDVtUDF1N0JGb00xNEtoUG9PM2JiL0pDZVJiNE4zSzFXbDdOSGZ1RTl5YTB0b0tiV0xDcXRFTU8rNXFJNUx5RWdwaXgvUko5TWVoVT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
8f94c34640d5f28f0157715396f0fcc3583fce5342bc7f44ce8baf3464ddda9e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
912979
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=iec2lHxTNnROeFhDcTNveWloNzZQZGNMb2NvLzlPMEtxNXJreXB1eVZGbnBQVW8zVC9tZndpejlTSHliS2xXa2ZuQTJCYWxzOStEMXY0UEZ3TVk0NTZ5aGRhOXZIYkUxOHYzOHV2QUxrN0VxZm44RjB3dGxGSnE5UzJ3OW81VFlSSWZDMStUY3B1b1NJWG9WbUtJVlhzSjY5VzVIaG5nVnEzeG1LQWwxem1RaytJZ3FUTEV3T2ZZY2NhS205NjltQ0VIMWtDTXpDakU2RUZJVzlDekNlRTc0WEdQRzI4T2RSbDlxcDVtUDF1N0JGb00xNEtoUG9PM2JiL0pDZVJiNE4zSzFXbDdOSGZ1RTl5YTB0b0tiV0xDcXRFTU8rNXFJNUx5RWdwaXgvUko5TWVoVT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
344454
content-length
0
expires
0
1
sync.connectad.io/umatch/ Frame 7EA8
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=connectad
  • https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da681694ab322ee-ORD
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:16 GMT Tue, 20 Jun 2023 19:44:16 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=2LK2FelB5bz5w6flSs8Z&pi=connectad
pragma
no-cache
cm
u.openx.net/w/1.0/ Frame C84B 		757 B
477 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
30a6d94c4a599137fb0867f1f6b6008950b81978f1982d91c805904b7852c7c4

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
458
content-type
text/html
date
Tue, 20 Jun 2023 19:44:16 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
via
1.1 google
1
sync-eu.connectad.io/pixel/ Frame 352B
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=rtaplus&user_id=VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy&gdpr=0
  • https://sync.mathtag.com/sync/img?mt_exid=46&redir=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D80%26user_id%3D%5BUUID%5D%26expires%3D30%26ssp%3Drtaplus%26bsw_param%3Db906d225-1d58-4500-8893-66f3b5de01e...
  • https://x.bidswitch.net/sync?dsp_id=80&user_id=c0d66492-0183-4f00-930f-e67415c7188d&expires=30&ssp=rtaplus&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=0&gdpr_consent=
  • https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da68169ab4622ee-ORD
date
Tue, 20 Jun 2023 19:44:17 GMT
server
cloudflare

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:16 GMT
Location
//sync-eu.connectad.io/pixel/1?dataid=data3&uuid=b906d225-1d58-4500-8893-66f3b5de01e6
Server
nginx
1
sync.connectad.io/umatch/ Frame DBA4
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dadform%26dataid%3Ddata4%26uuid%3D%24UID
  • https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da68169ab3c22ee-ORD
date
Tue, 20 Jun 2023 19:44:17 GMT
server
cloudflare

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:16 GMT
location
https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1598040676591792150
server
nginx
VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy
csync.smilewanted.com/set_partner_userid_get/connectad/ Frame 0E43 		0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/connectad/VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68168b9a24400-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare
vary
Accept-Encoding
1
sync.connectad.io/umatch/ Frame 3917
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dsovrn%26dataid%3Ddata12%26uuid%3D%24UID
  • https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da681696ae922ee-ORD
date
Tue, 20 Jun 2023 19:44:16 GMT
server
cloudflare

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:16 GMT
Location
https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgiPZHAzppHjhCRtWlW-BH
X-Sovrn-Pod
ad_ap1dca1
ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame F6AC 		43 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a07:b5c0:eead:85e9:361a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
rum
dsum-sec.casalemedia.com/ Frame F6AC
Redirect Chain
  • https://ad.turn.com/r/cs?pid=21
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8301830339311477822
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8301830339311477822
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=497
Content-Length
43
Expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=4&external_user_id=8301830339311477822
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame F6AC
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=ZJIBgknqWgpSPnqrMo17egAADtAAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
  • https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
43 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
H2
Server
2600:1f18:4e9:5a07:b5c0:eead:85e9:361a Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43

Redirect headers

location
https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBgknqWgpSPnqrMo17egAADtAAAAAB
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
crum
dsum-sec.casalemedia.com/ Frame F6AC
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/ie
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAD8LE7JJAMAAB-Q-u4sFQ&expiration=1688499856
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAD8LE7JJAMAAB-Q-u4sFQ&expiration=1688499856
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=496
Content-Length
43
Expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAD8LE7JJAMAAB-Q-u4sFQ&expiration=1688499856
Date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
crum
dsum-sec.casalemedia.com/ Frame F6AC
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=2079
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=968062838393799511
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=968062838393799511
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=57&external_user_id=968062838393799511
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Jetty(9.4.51.v20230217)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
rum
dsum.casalemedia.com/ Frame F6AC
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=index
  • https://sonata-notifications.taptapnetworks.com/web/cookie/bidswitch/sync?bidswitch_ssp_id=index&bsw_custom_parameter=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&gdpr_pd=
  • https://x.bidswitch.net/sync?dsp_id=413&ssp=index&user_id=csonata_027c9f7f-9cca-4583-8476-8ba6a3d62fc9&bsw_param=b906d225-1d58-4500-8893-66f3b5de01e6&expires=10&gdpr=&gdpr_consent=&gdpr_pd=
  • https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:17 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=498
Content-Length
43
Expires
0

Redirect headers

Location
//dsum.casalemedia.com/rum?cm_dsp_id=51&external_user_id=b906d225-1d58-4500-8893-66f3b5de01e6&gdpr=&gdpr_consent=&us_privacy=
Date
Tue, 20 Jun 2023 19:44:17 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
rum
dsum-sec.casalemedia.com/ Frame F6AC
Redirect Chain
  • https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=dd8be30d-cfe6-0402-a26c293a
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=dd8be30d-cfe6-0402-a26c293a
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=497
Content-Length
43
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:16 GMT
via
1.1 google
server
nginx/1.24.0
p3p
CP='This is not a P3P policy!'
access-control-allow-origin
*
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=dd8be30d-cfe6-0402-a26c293a
content-type
text/html; charset=utf-8
cache-control
max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
146
crum
dsum-sec.casalemedia.com/ Frame F6AC
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=c0d66492-0183-4f00-930f-e67415c7188d
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=c0d66492-0183-4f00-930f-e67415c7188d
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=498
Content-Length
43
Expires
0

Redirect headers

Date
Tue, 20 Jun 2023 19:44:16 GMT
Server
MT3 1031 59fd23a master iad iad-pixel-x11 config_version:"1969"
Content-Type
image/gif
Access-Control-Allow-Origin
*
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=c0d66492-0183-4f00-930f-e67415c7188d
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 20 Jun 2023 19:44:15 GMT
1
sync.connectad.io/umatch/ Frame F6AC 		0
610 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.connectad.io/umatch/1?bidder=idx&dataid=data13&uuid=ZJIBgknqWgpSPnqrMo17egAA%263792
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7da681693a9622ee-ORD
alt-svc
h3=":443"; ma=86400
1
sync.connectad.io/umatch/ Frame C84B 		0
635 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.connectad.io/umatch/1?dataid=data5&uuid=0557d8e0-6f29-46d6-b42c-86d2012decc5
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7da681692a8522ee-ORD
alt-svc
h3=":443"; ma=86400
sd
us-u.openx.net/w/1.0/ Frame C84B
Redirect Chain
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=4&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072977&val=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072977&val=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
server
A
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location
https://us-u.openx.net/w/1.0/sd?id=537072977&val=e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&gdpr=0&gdpr_consent=
cache-control
max-age=0,no-cache,no-store
content-length
0
expires
Tue, 11 Oct 1977 12:34:56 GMT
receive
pixel.tapad.com/idsync/ex/ Frame C84B 		95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=1955&partner_device_id=3af724d3-8db1-48b8-9541-de11b3faef44
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95
sync
ups.analytics.yahoo.com/ups/58294/ Frame C84B 		0
150 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58294/sync?_origin=1&uid=124dd4a6-0edc-4f76-8c87-87cd17d5da21
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-225-218-10.compute-1.amazonaws.com
Software
ATS/9.1.10.57 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
396846.gif
idsync.rlcdn.com/ Frame C84B
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fid.rlcdn.com%2F464246.gif%3Fpartner_uid%3D
  • https://id.rlcdn.com/464246.gif?partner_uid=694f2849-1bf1-435f-80d9-c634b9ed4f90
  • https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
  • https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=694f2849-1bf1-435f-80d9-c634b9ed4f90
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=694f2849-1bf1-435f-80d9-c634b9ed4f90
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:17 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

date
Tue, 20 Jun 2023 19:44:16 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=694f2849-1bf1-435f-80d9-c634b9ed4f90
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sd
us-u.openx.net/w/1.0/ Frame C84B
Redirect Chain
  • https://ib.adnxs.com/getuid?https://us-u.openx.net/w/1.0/sd?id=537072399&val=$UID
  • https://us-u.openx.net/w/1.0/sd?id=537072399&val=1179662177681492769
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072399&val=1179662177681492769
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Tue, 20 Jun 2023 19:44:16 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.178; 149.56.153.178; 564.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
ffa3342f-97ea-4bbc-8dd8-9a1316fb5778
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://us-u.openx.net/w/1.0/sd?id=537072399&val=1179662177681492769
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame C84B
Redirect Chain
  • https://ad.turn.com/r/cs?pid=9&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537073061&val=8301830339311477822&gdpr=0&gdpr_consent=&us_privacy=
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8301830339311477822&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537073061&val=8301830339311477822&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
syncframe
gum.criteo.com/ Frame 3897 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:16 GMT
server
Kestrel
server-processing-duration-in-ticks
929951
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
syncframe
gum.criteo.com/ Frame 181E 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:16 GMT
server
Kestrel
server-processing-duration-in-ticks
1120328
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
syncframe
gum.criteo.com/ Frame 7A2B 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:16 GMT
server
Kestrel
server-processing-duration-in-ticks
655973
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
1
sync.connectad.io/umatch/ Frame 1E4D 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?dataid=data1&uuid=8E87CD5E-E863-49F4-8101-49E63E3D4BD9
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:10::6816:36ce , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da68169cb8122ee-ORD
date
Tue, 20 Jun 2023 19:44:17 GMT
server
cloudflare
sid
mug.criteo.com/ Frame 3897
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=P_MnunxxMStjcVluakp5NG5EYW1BNGUzWHZUZExQZjFmS0RzN0FHaXhGdDBTTXV4VGlwYkhxaDhjbXY5OFBreFVhcHo0NUM2NWNpQzd6bEdzNHRCbzlZR2p4SFJjWnJOczBYSTVJMVh3a3lOZnUyQVNKdGlhOWpUN0tSWV...
433 B
653 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=P_MnunxxMStjcVluakp5NG5EYW1BNGUzWHZUZExQZjFmS0RzN0FHaXhGdDBTTXV4VGlwYkhxaDhjbXY5OFBreFVhcHo0NUM2NWNpQzd6bEdzNHRCbzlZR2p4SFJjWnJOczBYSTVJMVh3a3lOZnUyQVNKdGlhOWpUN0tSWVgvek5TVW1JUm4rVWVVbmFxb1k2ZGY5cS9FMXVHWUg2NHRxWW83SFEvTXJnZFFCSVFoa3dnQWtKT3JxZVpBS0t5cUlienVBd2IzWFVhUVU2WE5BV2xTNWNjZDduUkV0V3BUT2tseEJ1Z3NzNTkxVmcxTWdDQ2FCL2NCRU8wODVjbWs5NTFMQjVtL21vVmQ5WWVUT3dwMzdRUmNIL2JEZS8xK1BiRUhHQlF4M3pnRDlydkxlTT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
077ef38850eff4b2826b88ee927b76f06a14d993f9494b2a38b70f1bbcf45ee5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1450578
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=P_MnunxxMStjcVluakp5NG5EYW1BNGUzWHZUZExQZjFmS0RzN0FHaXhGdDBTTXV4VGlwYkhxaDhjbXY5OFBreFVhcHo0NUM2NWNpQzd6bEdzNHRCbzlZR2p4SFJjWnJOczBYSTVJMVh3a3lOZnUyQVNKdGlhOWpUN0tSWVgvek5TVW1JUm4rVWVVbmFxb1k2ZGY5cS9FMXVHWUg2NHRxWW83SFEvTXJnZFFCSVFoa3dnQWtKT3JxZVpBS0t5cUlienVBd2IzWFVhUVU2WE5BV2xTNWNjZDduUkV0V3BUT2tseEJ1Z3NzNTkxVmcxTWdDQ2FCL2NCRU8wODVjbWs5NTFMQjVtL21vVmQ5WWVUT3dwMzdRUmNIL2JEZS8xK1BiRUhHQlF4M3pnRDlydkxlTT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
333178
content-length
0
expires
0
sid
mug.criteo.com/ Frame 181E
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=DZ6T03wwdHYyRUx3U29jWkJjS2hPMHZoWGMzZUh0UXpzOE05UHNoSUw4NUpDZlU0NHZCaG1INnpMU3VtREhHN2kxUVZYMFhIbFYycnF2NlF3Nmx1a2FHdllUU21SblEzOWNhUXduWTcwU281eGlwZVM4SmRYMkpJQSsxYW...
417 B
648 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=DZ6T03wwdHYyRUx3U29jWkJjS2hPMHZoWGMzZUh0UXpzOE05UHNoSUw4NUpDZlU0NHZCaG1INnpMU3VtREhHN2kxUVZYMFhIbFYycnF2NlF3Nmx1a2FHdllUU21SblEzOWNhUXduWTcwU281eGlwZVM4SmRYMkpJQSsxYWJPVGUrOWZDRlFibnp1dGdyWkplUXpUNzBBaVFQcFZralZvajVoNnBndVB2UXFtWjNaQ2hQRWFsYXUvb213T2k0Z0V3ZEJJY3JLd1NxcS81M01xVC81YTVlSjl2ZkVBMnliVnYxVEF3dTJjcHR3VTJaVUlaUzNUdmhiTVNpV1gxQUpzWDR4QUY2T2hFeXRRa0tUVjN2T1d5ZzEwWjVGOEQ2YWFLdVowUDI5NERoazl3OTJDQT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
3dcd45666d5b57f86b6ebc07ca730eb83ef434fc8ae9bc1d345cddeb3cfd140c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
884975
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=DZ6T03wwdHYyRUx3U29jWkJjS2hPMHZoWGMzZUh0UXpzOE05UHNoSUw4NUpDZlU0NHZCaG1INnpMU3VtREhHN2kxUVZYMFhIbFYycnF2NlF3Nmx1a2FHdllUU21SblEzOWNhUXduWTcwU281eGlwZVM4SmRYMkpJQSsxYWJPVGUrOWZDRlFibnp1dGdyWkplUXpUNzBBaVFQcFZralZvajVoNnBndVB2UXFtWjNaQ2hQRWFsYXUvb213T2k0Z0V3ZEJJY3JLd1NxcS81M01xVC81YTVlSjl2ZkVBMnliVnYxVEF3dTJjcHR3VTJaVUlaUzNUdmhiTVNpV1gxQUpzWDR4QUY2T2hFeXRRa0tUVjN2T1d5ZzEwWjVGOEQ2YWFLdVowUDI5NERoazl3OTJDQT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
278912
content-length
0
expires
0
sid
mug.criteo.com/ Frame 7A2B
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=lAphDXxvYkZnUGZmUEdFUnNSNVVtSGVsT0Npbm1VQ21nc3RKenhmdFdGaTBTYWxzc0JyUGRuRTZQU0ZkOFc4MUpjU2F0WTgrdk1GYWdUN0ZQcW8yZitFSG1wWmpkTEFaRXg0T24vUWpzbzErUFIxSkVZVjdSbzZZSzI1K3...
433 B
652 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=lAphDXxvYkZnUGZmUEdFUnNSNVVtSGVsT0Npbm1VQ21nc3RKenhmdFdGaTBTYWxzc0JyUGRuRTZQU0ZkOFc4MUpjU2F0WTgrdk1GYWdUN0ZQcW8yZitFSG1wWmpkTEFaRXg0T24vUWpzbzErUFIxSkVZVjdSbzZZSzI1K3dMd2F0d0c3U2pmRHNNMTRuOEgrL3NLNnNjZkNCdXIrQXBRU1FidTBoUjE3czI1SzVGWG4rRFdkVForcVZxaUdYQVVvUkFRZ2NoYmZBc1grVC9Zbkx2dk85aVlXWGNBOWQ3T2E2SS9TTTBNby95MDk5bVhVVlpFTlM3Vm9qUFhEbXhOZlE1ZThrSU5iQU8vTEk1Znpsd21JZXRhMVcwQ3doeFFrSCsxazBNa002dlArQUlmND18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
85856a36baf6ffc82ff928f4bcc07cab5097a0dabb7d6dc56fff6d7246db05db
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
914408
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:16 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=lAphDXxvYkZnUGZmUEdFUnNSNVVtSGVsT0Npbm1VQ21nc3RKenhmdFdGaTBTYWxzc0JyUGRuRTZQU0ZkOFc4MUpjU2F0WTgrdk1GYWdUN0ZQcW8yZitFSG1wWmpkTEFaRXg0T24vUWpzbzErUFIxSkVZVjdSbzZZSzI1K3dMd2F0d0c3U2pmRHNNMTRuOEgrL3NLNnNjZkNCdXIrQXBRU1FidTBoUjE3czI1SzVGWG4rRFdkVForcVZxaUdYQVVvUkFRZ2NoYmZBc1grVC9Zbkx2dk85aVlXWGNBOWQ3T2E2SS9TTTBNby95MDk5bVhVVlpFTlM3Vm9qUFhEbXhOZlE1ZThrSU5iQU8vTEk1Znpsd21JZXRhMVcwQ3doeFFrSCsxazBNa002dlArQUlmND18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
489024
content-length
0
expires
0
dc_oe=ChMI2YLl_s3S_wIVlw2ICR3O7wFsEAAYACD77KpV;met=1;&timestamp=1687290260006;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 8832 		42 B
401 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI2YLl_s3S_wIVlw2ICR3O7wFsEAAYACD77KpV;met=1;&timestamp=1687290260006;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.35.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s78-in-f2.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:20 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
us-match.taboola.com/ Frame CE21 		5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://us-match.taboola.com/sync?dast=V8NMUCLAbgGQEK4mdf3xLAMwIUxM--vi0AAABgYID-AAl5fLONbTFyK3cTx1o0GtncCo9juRYuJw6XwznxeDyWISAhj2-2sS1GbuVu4liLRiObW-FxLNfC5cThcjgnHo_HMgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxRA-mcjUJE3zXyIEjUUYAQAAAKjEyZQ9MkknqFhU-f__77cCcAUAIABRuyocNIvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjmIxcvoXNOXO4TA6PyTaZ2RwTi8NkWa4MM8dqeyRjf1xaaPRh-4QIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYIZk3Ox2XhMa8XMsnGLFjbfWrhZLtcqy8w1srg2y5lhsxa9PqaLcWLcDRZbJBiwuBfJ0yKdKGcu32K5WplmvtXItZk5ZibHardZuZzL1WY4M0zEEs3JIp3ILvuOYTJy-RY258zhMjk8JttkZnNMLA6TZbkyzByrfcfkXGw2HtNaMbNs3KKFzbcWbpbLtcoyc40srs1yZtisRa-P6WKcGHeDxb4xG-4my8FktNg3ZsPdZDmYjBb7Dp3hu_qcjdLJUuzxaRfGcktncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrtgNVwkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrHHryAGw8lg_wBUiLVarW431mq1AA!&excid=22&docw=0&cijs=1&nlb=false
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
93e018a7792b5464deeca7b2e56fae7f27d31ae4250c6544744e06afdd4fe64c

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
text/html;charset=ISO-8859-1
date
Tue, 20 Jun 2023 19:44:24 GMT
machineid
3108
server
nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768250&size_id=43&alt_size_ids=44&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=73cda8a7-7d91-4bd6-aa8f-4db354ba5785&l_pb_bid_id=22b6edfd84c915d&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=73cda8a7-7d91-4bd6-aa8f-4db354ba5785&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%231&slots=1&rand=0.4342673499040146
Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768236&size_id=15&alt_size_ids=9%2C10%2C54&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=24f1d729-8923-4a11-9165-f44d72ae151a&l_pb_bid_id=24d6938bad6d89a&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=24f1d729-8923-4a11-9165-f44d72ae151a&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&slots=1&rand=0.8166875380863574
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzAweDUw&v=5&s=v31h3d5br91&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=4858046&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekF3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMDAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6OTcweDI1MA==&v=5&s=v31h3d5brcu&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=8491294&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZPVGN3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyNTI4NjM2ODc2LCJ3IjoiOTcwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzAweDUw&v=5&s=v31h3d5bsdt&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=4712238&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekF3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMDAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6OTcweDkw&v=5&s=v31h3d5bskv&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=2834278&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZPVGN3ZURrdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiI5NzAiLCJoIjoiOTAifSwid3IiOjJ9
Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=%2F21671350435%2C208595991%2F300x250-mercurynews.com&tk_flint=pbjs_lite_v7.19.0&x_source.tid=fe3165cd-e85e-48b8-ad07-7a9d157f6e80&l_pb_bid_id=14d2b68a3552d3c&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8349608322155124
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6OTcweDI1MA==&v=5&s=v31h3d5btq2&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=433625&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZPVGN3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyNTI4NjM2ODc2LCJ3IjoiOTcwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzAweDUw&v=5&s=v31h3d5btud&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=4541594&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekF3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMDAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6OTcweDkw&v=5&s=v31h3d5bur5&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=4556634&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZPVGN3ZURrdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiI5NzAiLCJoIjoiOTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzIweDUw&v=5&s=v31h3d5bv2s&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=9098899&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekl3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMjAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
cdn.8proof.com
URL
https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-800.woff2
Domain
cdn.8proof.com
URL
https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-600.woff2

Verdicts & Comments Add Verdict or Comment

402 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 boolean| credentialless object| onbeforetoggle object| onscrollend object| scriptHelpers function| loadCSS object| _wpemojiSettings object| twemoji object| wp object| htlbid object| MNG_SSO_CONNEXT_EVENT_TIMING_ANALYTICS number| MNG_SSO_TOOLS_GLOBAL_START_TIME function| $ function| jQuery object| MG2 function| PluginInitOverride object| MG2Loader string| loaderVersion string| loaderBuild object| appInsights object| deferredResources function| blmGetIcon object| google function| reactiveElementPolyfillSupport object| reactiveElementVersions object| module$contents$mapsapi$overlay$overlayView_OverlayView function| createAuth0Client function| Auth0Client object| default_gsi object| authentication_config object| entitlements_config object| regeneratorRuntime function| simpleEmailValidation function| validatePhoneNumber object| MNGAuthentication boolean| disableAuth0AuthFlow function| backToStory object| PushlySDK object| dfm_pushly_options object| blueConicPreListeners function| BCClass object| blueConicClient object| dataLayer function| Osano function| __gpp function| __tcfapi function| __uspapi function| mg2WidgetAPI object| DFM_AD_MODS_LEVEL object| DFM_AD_MODS_DEBUG object| article_config object| _taboola function| analyticsEvent function| analyticsSocial function| analyticsVPV function| analyticsClearVPV function| analyticsForm function| closeMobileAdhesionAd function| keyboardHandler object| bloom_meta string| bloom_domain function| blmInit function| blmKeyUp function| blmTrigger function| blmMapLaunch function| blmMapClose function| blmGetMetadata object| bloom_nns boolean| bloom_nns_cookies_enabled object| bloom_nns_remote number| bloom_nns_remote_delay number| bloom_nns_iv_pulse boolean| bloom_amp function| blmSearchInit function| blmSearchLoad function| blmSearchLaunch function| blmSearchInitWindow function| blmSearchIconAction function| blmSearchKeyUp function| blmSearchOpen function| blmSearchClose function| blmSearchGeolocation function| blmSearchGeolocationResponse function| blmSearchLoadRemoteContent function| blmSearchSetLayout function| blmSearchGetLayout function| blmSearchUrlRequest function| blmSearchUrlParamParse function| blmSearchUrlParamModify function| blmSearchSupports function| blmSearchGetUserDistance function| blmSearchSetCookie function| blmSearchGetCookie function| blmSearchDeleteCookie object| runtime object| picturefillCFG function| picturefill object| lazySizesConfig object| lazySizes function| setImmediate function| clearImmediate object| wpParselyHooks object| PARSELY function| _typeof object| __G_ID_CLIENT__ object| closure_lm_941801 boolean| dfmCanRunAds object| webpackChunkknowlton function| Headroom function| Hammer object| AI object| Microsoft function| __extends function| _endsWith object| bc_json823 boolean| htlbidLoaded object| pbjsChunk object| pbjs object| _pbjsGlobals function| HTLBIDLoader object| googletag object| apstag object| bc_json822 object| dfm_viafoura_options object| vfQ object| _stq object| webVitals object| TRC object| _tblConsole string| pm_pgtp undefined| msg object| _comscore object| google_tag_manager object| google_tag_data object| litHtmlVersions object| ggeac object| google_js_reporting_queue function| st_go function| linktracker_init object| wpcom object| bloom_nns_el_button_current object| bloom_nns_el_button_current_label object| bloom_nns_el_header object| bloom_nns_el_header_title object| bloom_nns_el_header_landscape object| bloom_nns_el_header_landscape_balls object| bloom_nns_el_header_landscape_ball object| bloom_nns_el_content object| bloom_nns_el_content_local object| bloom_nns_el_content_local_banner object| bloom_nns_el_content_local_banner_text object| bloom_nns_el_content_local_banner_close object| bloom_nns_el_content_remote object| bloom_nns_el_content_local_intro object| bloom_nns_el_content_local_intro_title object| bloom_nns_el_content_local_intro_options object| bloom_nns_el_content_local_intro_options_button object| bloom_nns_el_content_local_intro_options_search object| bloom_nns_el_content_local_intro_options_search_input object| bloom_nns_el_content_local_intro_options_search_button object| bloom_nns_el_footer object| bloom_nns_el_footer_attribution object| bloom_nns_el_footer_arrow object| bloom_nns_el_footer_arrow_inner string| GoogleAnalyticsObject function| ga string| comscoreID object| _qevents string| ssaUrl object| _aps boolean| apstagLOADED object| _rmxd object| vfConfig object| LoaderConfig function| quantserve function| __qc object| ezt object| _qoptions undefined| google_measure_js_timing object| Criteo object| apscustom boolean| htlbidStarted function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcWarnUsingBeacon function| __trcDOMWalker function| __trcJSONify function| __trcUnJSONify function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam number| trc_debug_level string| trc_article_id object| TRCImpl object| confiant object| launchPad object| launchPadConfiguration object| node function| __launchpad function| gtag object| GooglebQhCsO function| InteractionTypeImpl number| taboola_view_id object| bc_json824 boolean| creativeVendorLibraryLoaded string| fpVersion string| fpBuild object| DeviceDetector object| Fingerprint object| g2ExtendInits object| G2Analytics object| G2Insights object| MG2Insights boolean| _tb_dis string| pm_ppy string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv object| _pma undefined| _tb_d undefined| _tb_rand object| _pm_ecd function| _pmloadfile function| pmws_request_done function| _tb_getUrlParameter object| __uid2SecureSignalProvider object| __uid2 object| criteo_pubtag object| criteo_identitytag_137 object| Criteo_identitytag_137 object| gaplugins object| gaGlobal object| gaData object| nxtBundle object| webpackJsonpnxtBundle object| NxtInner object| Connext object| CnnXt object| MG2DL object| _bcp object| Mustache function| BlueConicMetaDataService function| RuleService object| justDetectAdblock object| bc function| jwt_decode function| BlueConicEngagement object| bcConnectionUtil function| BlueConicDataLayerUtility function| md5 function| fbq function| _fbq function| onYouTubeIframeAPIReady object| LI object| __li__evt_bus object| liQ object| liQ_instances object| COMSCORE object| ns_p object| _mather object| _mg2q object| _matherq object| tid undefined| nQuery number| ntvLoadStart object| ntv object| prdom object| onFocusEvents function| ntvjQueryInit function| ntvExtends function| ntvAppendStylesheet function| ntvAppendScript function| ntvGetElementViewability function| ntvArticleTracker function| ntvViewableImpressionTracker object| PostRelease object| ntvToutAds boolean| onFocus function| bt_eval function| bt_parameter function| bt_meta function| bt_cookie function| bt_data function| bt_log function| bt_handle_exception undefined| _bt_url_prefix undefined| _bt_referrer undefined| _bt_site undefined| _bt_mode function| btServe function| bt_data_escaped object| BrightTag function| TBVideoElem function| TBVideoEvents function| TBOptimizationAutoPlayInfoFromXPathAndURL object| _pmk function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBVideo function| TBVideoDetectionYoutubeAPI function| TBOptimizationTouchAndClickEventTracker function| TBWidgetStorage object| PMFileLoader object| PMPage object| PMTemplate function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| PMGlobal function| pmws_getlocation_done object| pmdebug object| pmws object| ji object| _pm_mcg function| _____WB$wombat$assign$function_____ function| __WB_pmw object| gPartners string| nam object| placementData object| bc_json825 object| criteo_syncframe_state function| processGoogleToken object| googleToken object| googleIMState number| google_unique_id object| cmTag function| _typeof2 function| __liSync object| bc_json826 function| UET function| UET_init function| UET_push function| confiantDfpWrap object| _cm_wfCounters object| criteo_pubtag_prebid_135 object| Criteo_prebid_135 object| confiantRefreshSlots object| confiantRefreshSlotsDebug object| adpnExecutions object| aliveChecks boolean| adpnLoaded function| _createForOfIteratorHelper function| _unsupportedIterableToArray function| _arrayLikeToArray number| lnt_z object| uetq object| tbopt object| GoogleGcLKhOms function| CallTrkSwap function| CallTrk object| ueto_a85cfe7403 object| google_image_requests

319 Cookies

Domain/Path Name / Value
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ Name: bloom_page_location_address
Value:
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ Name: bloom_page_location_latlon
Value: ,
.taboola.com/medianewsgroup-mercurynews/ Name: taboola_session_id
Value: v2_c02de7af9faedacd62ff1bbad29e0f15_cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701_1687290241_1687290241_CNawjgYQtdRXGOvB19KNMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB
a869.mercurynews.com/DG/DEFAULT Name: BCSessionID
Value: 53d732a1-8120-4fad-8c05-821f63a4cd3a
.3lift.com/sync Name: sync
Value: CgkIOhDm6NfSjTE=
i.liadm.com/s Name: _li_ss
Value: CkAKBQgKEKwVCgUIBhCsFQoGCIEBEKwVCgYIogEQrBUKCQj_____BxC2FQoFCAsQrBUKBgiLARCsFQoGCNIBEKwV
i6.liadm.com/s Name: _li_ss
Value: CgA
.mercurynews.com/ Name: bc_tstgrp
Value: 9
.mercurynews.com/ Name: _pnvl
Value: false
.mercurynews.com/ Name: pushly.user_puuid
Value: AEA60ebQTuv6MW9Wmw1WZsTIk4yUchZf
.mercurynews.com/ Name: _parsely_session
Value: {%22sid%22:1%2C%22surl%22:%22https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/%22%2C%22sref%22:%22%22%2C%22sts%22:1687290240153%2C%22slts%22:0}
.mercurynews.com/ Name: _parsely_visitor
Value: {%22id%22:%22pid=5f712203e2372b307f5c6c6ccb85d754%22%2C%22session_count%22:1%2C%22last_session_ts%22:1687290240153}
www.mercurynews.com/ Name: ai_user
Value: 2cSqd|2023-06-20T19:44:00.278Z
.viafoura.co/ Name: VfSess
Value: h6r1jqm6i408nuijisi4bpph76
.viafoura.co/ Name: vfThirdpartyCookiesEnabled
Value: true
.sitescout.com/ Name: ssi
Value: e1133e9b-79ec-4417-a46d-cc5a4e9307a9#1687290240716
.scorecardresearch.com/ Name: UID
Value: 12C0d32cec79b0c5fbe8cdf1687290240
digitalfirstmedia.blueconic.net/ Name: AWSALBCORS
Value: UkenD0z5azFIHgc5W4WfXnguAd1XZLp7p0kbeE3zQfQGEihr6MNUrQnSrpuTtrDELOcWQDF2zPEWM/cJH72KgryvwyAoj3vtzaMWl/77lyaZGzpRDzUX1QgsmgHn
www.mercurynews.com/ Name: _vfa
Value: www%2Emercurynews%2Ecom.00000000-0000-4000-8000-c86bf0725f23.68c652e6-3b14-4e77-9213-660e8ebf8a4b.1687290240.1687290240.1687290240.2
www.mercurynews.com/ Name: _vfz
Value: www%2Emercurynews%2Ecom.00000000-0000-4000-8000-c86bf0725f23.1687290240.2.medium=direct|source=|sharer_uuid=|terms=
.viafoura.co/ Name: vfDeviceId
Value: 0ff63511-9be4-4dee-bfcb-fc309785ad02
.mercurynews.com/ Name: _gcl_au
Value: 1.1.1333905033.1687290241
.adnxs.com/ Name: uuid2
Value: 1179662177681492769
.tapad.com/ Name: TapAd_TS
Value: 1687290241165
.tapad.com/ Name: TapAd_DID
Value: 76c19607-052e-43a5-b5b2-1d6cfe831e64
.demdex.net/ Name: demdex
Value: 71078745604161724080825924744581615606
.teads.tv/ Name: tt_viewer
Value: 2b3d07bb-57ac-4d85-b9d4-a3e57f22183b
.mercurynews.com/ Name: osano_consentmanager_uuid
Value: cdfb92e1-eb16-4858-beff-9c9fb377bac2
.mercurynews.com/ Name: osano_consentmanager
Value: uWsfvE9nkjPD4bS-fVfbsWrLu8fzm6lxXfWwE_UKa3uw_4vZKsF1EcXAxdkynh3JU-D-sY77xwSkJhpzwDdDwdJQ-AHEb0SNmTgWgeWKyF81fTOxkzjbbhPuuWsaWtRgk3v95BNnu7Vz36ajrsVPZ3uhfKH-WGObu4EOypUuYieM8Ly5SmVrOMzJOhvJ0e0cesmX3ON1YF3NOLHnMYwqdg6HWmMA_diSBuvxOhy6CbzOmnom-da2x5cQMah00ie4ESapBf9eV0Y8L5FKZRIqEfibD00XXd33co7klpdokAoml_p9IWevStiaFvnUxlrj-eIspTXFB_z92lUfDGw9iaxS-pP_LzF4jhRQE_5n_ixr67nLh4fe_VwqRh29w0mFmdbXqNibwBdP2NezvLWsEZVDEy14IFzGDwsQL15hMxYzh_Rf3sTKbszq_u_HK91HpJXPPBHabdLfqs7VN0kuUb80pddyFZiBlmBYmIqam6Oz5llC0ohJTqmoyLXCws3GIFxud8jekxBKTZmAizXmepJrc1dk0Tnn0LQJRS-3av7pl8LcoX7hL-8wU9NLWaVb9BWbwZQQ7gRD-9TtfFjhtMGiIHFFsMoLIKe77p_iXTYtIOz-w7Pm56RNXXdf5586PHQQljMB_c1Q0INI0gjauEneta8qACWHVC31WNQmX29TLTNGGIqBGe7EXlRQkM5NHDXFRLYtiSyGuWTckRIxtRRySyJ7UA4_wHciw-3eWHK4BegvFp96PepeEZGHBdOl-zbBH0g3JTWNGE6C7-ci-1IerC6nyzlS
www.mercurynews.com/ Name: BCSessionID
Value: 53d732a1-8120-4fad-8c05-821f63a4cd3a
www.mercurynews.com/ Name: _vfb
Value: www%2Emercurynews%2Ecom.00000000-0000-4000-8000-c86bf0725f23.1.10.1687290240....
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: a433a0635e30a7fd76ec22a26382a12
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4XmOQTzQxNk40MDM2TTU2SDRPSzE3S002Mko0MjO2MEo0NGIAgpRJjI0gGgoANzAJrw%3D%3D"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4XmNgYGBImcTYCKSgAAASiwF5"
.dpm.demdex.net/ Name: dpm
Value: 71078745604161724080825924744581615606
.mercurynews.com/ Name: _gid
Value: GA1.2.1597915438.1687290241
.exelator.com/ Name: EE
Value: "ccefd08a7a2dee4d7fe9c6bf481a14a8"
.mercurynews.com/ Name: nxt_last_visit
Value: 1687290241596
.quantserve.com/ Name: mc
Value: 64920181-a0fee-e7ee7-fcf7f
.amazon-adsystem.com/ Name: ad-id
Value: A9uibSXVhkjdnGrHS4j2ekQ
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQSE5OTUtxcAi0TzRKCU11STFPC3VMtksKc3EwjDR0CTRYnFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDQZEl%252BUWb6ImfHxUUpaQyLSopPBR%252FJ1QYADecrEA%253D%253D"
.mercurynews.com/ Name: _li_dcdm_c
Value: .mercurynews.com
.mercurynews.com/ Name: _lc2_fpi
Value: f107d3ac6b63--01h3d5brztmkkvrpvtgqfg6b8b
.mercurynews.com/ Name: _ml_ses
Value: *
.mercurynews.com/ Name: _matheriSegs
Value: MATHER_U9_INSTANTB_20200203
.mercurynews.com/ Name: _matherSegments
Value: MATHER_U9_INSTANTB_20200203
www.mercurynews.com/ Name: ntv_as_us_privacy
Value: 1---
.mercurynews.com/ Name: __qca
Value: P0-2031367367-1687290240919
.mercurynews.com/ Name: _ga_LMTT1ZNHB1
Value: GS1.1.1687290241.1.0.1687290242.0.0.0
.postrelease.com/ Name: visitor
Value: c8e443b3-cc17-45dd-b2ff-7eecb8f5663b
.postrelease.com/ Name: status
Value: 0
.rubiconproject.com/ Name: khaos
Value: LJ4P1MPG-1E-GIGU
.liadm.com/ Name: lidid
Value: 4160af57-86ed-4458-b49b-256a547d062b
.taboola.com/ Name: t_gid
Value: cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701
www.mercurynews.com/ Name: trc_cookie_storage
Value: taboola%2520global%253Auser-id%3Dcd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701
.smaato.net/ Name: SCM
Value: 95cec808
.smaato.net/ Name: SCMaps
Value: 95cec808
.media.net/ Name: visitor-id
Value: 3302918421454631000V10
.casalemedia.com/ Name: CMID
Value: ZJIBgknqWgpSPnqrMo17egAA
.casalemedia.com/ Name: CMPS
Value: 3792
.casalemedia.com/ Name: CMPRO
Value: 3792
.contextweb.com/ Name: V
Value: VttZoBj38cya
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 814a0656b821a536
.gumgum.com/ Name: vst
Value: u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09
.sharethrough.com/ Name: stx_user_id
Value: 35620282-96f1-466f-b370-6daf818c9a83
.yieldmo.com/ Name: yieldmo_id
Value: gb63ffdf5e8844fc2dd8%7C1687290243075%7C0%7C
.smartadserver.com/ Name: pid
Value: 4614819635623485669
.criteo.com/ Name: uid
Value: e4d4e64e-e370-4886-a057-02f441b10d0f
a869.mercurynews.com/ Name: AWSALB
Value: ChHgpLUCkc8pVwomCiQeSyEuPYmDq//Fl0O673oxA/i6NT9XvHhRPGIUy8BRgKU/odsYCM5R9NSJmhmvnBtHZ5mUyqVlFN0R+vWmGOpW9FdM5wME1rj9yyP0rICG
a869.mercurynews.com/ Name: AWSALBCORS
Value: ChHgpLUCkc8pVwomCiQeSyEuPYmDq//Fl0O673oxA/i6NT9XvHhRPGIUy8BRgKU/odsYCM5R9NSJmhmvnBtHZ5mUyqVlFN0R+vWmGOpW9FdM5wME1rj9yyP0rICG
.doubleclick.net/ Name: IDE
Value: AHWqTUmWs1xnYO0Y_3L08p96zE4UHkhQ4IlX0ItIyiVw7ZoxB4xtJC39972X_xN7
.yellowblue.io/ Name: wrvUserID
Value: 1Y0qRO6akf_s
www.mercurynews.com/ Name: ntvSession
Value: {"id":7466784,"placementID":1028524,"lastInteraction":1687290243253,"sessionStart":1687290243253,"sessionEndDate":1687305600000,"experiment":""}
.3lift.com/ Name: tluid
Value: 3110826783617533917
www.mercurynews.com/ Name: _ntv_uid
Value: c8e443b3-cc17-45dd-b2ff-7eecb8f5663b
.kargo.com/ Name: ktcid
Value: 16db648e-e010-04a8-5d2d-f31bdb7d25c2
.postrelease.com/ Name: ver
Value: 1
.lijit.com/ Name: ljt_reader
Value: G2VgiPZHAzppHjhCRtWlW-BH
.openx.net/ Name: i
Value: ef256876-7f31-4ac8-8576-8e2fe4511db5|1687290243
.bidswitch.net/ Name: tuuid
Value: b906d225-1d58-4500-8893-66f3b5de01e6
.bidswitch.net/ Name: c
Value: 1687290243
.bidswitch.net/ Name: tuuid_lu
Value: 1687290243
.adsrvr.org/ Name: TDID
Value: 59f17c06-c5d2-4b1e-89aa-3d64ff091022
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZJIBgwATV5hRfwBa
.lijit.com/ Name: ljtrtbexp
Value: eJyrVrIwULIyNLOwMLG0tDAx1lGyMEXjm6PyTYxR%2BZYmyPxaAKq2EMM%3D
.mercurynews.com/ Name: _gat_UA-61435456-5
Value: 1
.mercurynews.com/ Name: _ga
Value: GA1.2.690102992.1687290241
.zemanta.com/ Name: zuid
Value: 7dYANMJyrp6NSRwK_hfM
.deepintent.com/ Name: CDIUSER
Value: di_997d12a216e84889bc024
.mathtag.com/ Name: uuid
Value: c0d66492-0183-4f00-930f-e67415c7188d
.ipredictive.com/ Name: cu
Value: 880a98a2-e5e4-4836-b912-8db1e124443a|1687290243470
.yahoo.com/ Name: A3
Value: d=AQABBIMBkmQCENv8PZWCK089CElBVhasyXgFEgEBAQFTk2SbZCXcxyMA_eMAAA&S=AQAAAj8VZjT3rQE_qZDkIED0ZmI
.go.sonobi.com/ Name: __uis
Value: 7f6700ef-9efd-41da-8a71-72c3ea800d51
.ads.yieldmo.com/ Name: ptrc
Value: CAESEL66ASCQJ_Y4vrCm-P3-keo
.ads.yieldmo.com/ Name: ptran
Value: 1179662177681492769
www.mercurynews.com/ Name: ai_session
Value: lPixg|1687290243578.8|1687290243578.8
.media.net/ Name: data-ris
Value: {{APID}}~~25
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 8E87CD5E-E863-49F4-8101-49E63E3D4BD9
.csync.loopme.me/ Name: viewer_token
Value: 8681e833-58ee-4151-9960-f1e5bdda03d8
.technoratimedia.com/ Name: tads_uidp_88
Value: 4549329987776476645579
.technoratimedia.com/ Name: tads_uidp_44
Value: LJ4M423I-A-GUZY
.technoratimedia.com/ Name: tads_uidp_77
Value: Qzx8Fth1lRqwLigKGeiGAZsRaeTFhsG7HikZr4WvlCU
.technoratimedia.com/ Name: tads_uidp_45
Value: BAD6476E-515C-40EF-942D-693B9AD99B7D
.technoratimedia.com/ Name: tads_uidp_46
Value: 1217274178440365
.technoratimedia.com/ Name: tads_uidp_79
Value: 9739f0dc-4496-442b-a959-2b6b95201cb9
.technoratimedia.com/ Name: tads_uidp_37
Value: 247a586e-c5ce-3545-bba1-139982a61504
.technoratimedia.com/ Name: tads_uidp_48
Value: 6f822bf7-18af-47d0-ad21-9b2af21c32f9
.technoratimedia.com/ Name: tads_uidp_49
Value: AAAH5BkkeQAXewN58w5kAAAAAAA
.technoratimedia.com/ Name: tads_uidp_7
Value: 65931951-d58d-4204-afe8-c07ee4873fcb
.technoratimedia.com/ Name: tads_uidp_80
Value: y-D.PpRcRE2uHJsnNC2yG8_3H.6VDsEdmT~A
.technoratimedia.com/ Name: tads_uidp_70
Value: 1673948501052-981480834937-007220-006-006384
.technoratimedia.com/ Name: tads_uidp_82
Value: ZJHuRJaUKzQetBEGb3FVdwAA&160
.technoratimedia.com/ Name: tads_uidp_50
Value: 6a187abd-1e6d-0749-2705-8f0c7e63efa7
.technoratimedia.com/ Name: tads_uidp_61
Value: 212190007873312
.technoratimedia.com/ Name: tads_uidp_62
Value: 3302869161454656000V10
.technoratimedia.com/ Name: tads_uidp_64
Value: hijRJ3_OEo5LeR5M4-2yElRogPowlNe8
.technoratimedia.com/ Name: tads_uidp_76
Value: RX-03dd6966-cee6-4582-8c02-bd63eb737b6f-005
.technoratimedia.com/ Name: tads_uid
Value: 568200899A48499D9AF846BF5A46F6A4
.technoratimedia.com/ Name: tads_uid_cd
Value: 20230331110957+0000
.technoratimedia.com/ Name: tads_zora
Value: 2
.360yield.com/ Name: tuuid
Value: 5adef92e-e872-4286-a590-6f8c8cb526ab
.360yield.com/ Name: tuuid_lu
Value: 1687290243
.outbrain.com/ Name: obuid
Value: 7b6e2ea2-0d33-497b-a0f1-08e7d6ef1fb1
.quantserve.com/ Name: sp
Value: CgwIv4EDEgYIg4PIpAY=
.33across.com/ Name: 33x_ps
Value: u%3D212190061405193%3As1%3D1687290243662%3Ats%3D1687290243662
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-72e8f41c-c614-5c44-7a44-34baa58f8010.IPcq7KuvXIvHy%2Fcm%2FOr1SuLbzetz6mNMVoKWfhwS3Og
sync.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3Acuj0HMYUXER6RDS6pY-AEJU4mbI.1BDflfuSpSy9M6DovaXXdkYv87jFdIf1EPfp8GLZa1g
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3Acuj0HMYUXER6RDS6pY-AEJU4mbI.1BDflfuSpSy9M6DovaXXdkYv87jFdIf1EPfp8GLZa1g
www.mercurynews.com/ Name: btpdb.t4tmU86.dGZjLjc1MDQ0Nzc
Value: U0VTU0lPTg
.blismedia.com/ Name: b
Value: 64920183F9D34782A4121D20BLIS
.bluekai.com/ Name: bku
Value: ikG99/1OAZujmn6Q
.creativecdn.com/ Name: u
Value: 2LK2FelB5bz5w6flSs8Z
.creativecdn.com/ Name: ts
Value: 1687290243
.mfadsrvr.com/ Name: tuuid
Value: 967ba71f-887a-40cd-a2cb-fd1cbcd221c2
.mfadsrvr.com/ Name: c
Value: 1687290243
beacon.lynx.cognitivlabs.com/ Name: UID
Value: 50113f91-7ace-4204-934b-46770b6d07a4
.lijit.com/ Name: _ljtrtb_80
Value: LJ4P1MPG-1E-GIGU
.lijit.com/ Name: _ljtrtb_43
Value: sxggjbUdIY6oTSnZ4Ek02rJJfIioSnrZskq7SIl1
.mercurynews.com/ Name: __gads
Value: ID=46f21ba418c8944f:T=1687290243:RT=1687290243:S=ALNI_Mb9T8C51CxOA0VbrwUKyKOrzu4s6g
.mercurynews.com/ Name: __gpi
Value: UID=00000c52bcfe7c0f:T=1687290243:RT=1687290243:S=ALNI_MYm7YW-LLGO3cnvTDwuDeHDm2mpiw
.bidr.io/ Name: bito
Value: AAD8LE7JJAMAAB-Q-u4sFQ
.bidr.io/ Name: bitoIsSecure
Value: ok
.rezync.com/ Name: zync-uuid
Value: 8df8ba75-afab-4bc2-a76d-d979183f805a:1687290243.9165657
.turn.com/ Name: uid
Value: 8301830339311477822
.mfadsrvr.com/ Name: tuuid_lu
Value: 1687290244
.socdm.com/ Name: SOC
Value: ZJIBg8Co8YQAAMZ2WjUAAAAA
.addthis.com/ Name: na_id
Value: 2023062019440400079707974041
.addthis.com/ Name: na_tc
Value: Y
.addthis.com/ Name: uid
Value: 64920184444f8e74
.addthis.com/ Name: ouid
Value: 6492018400017e87d50b55d68c95965d167b95a5c876917c7e0a
.lijit.com/ Name: _ljtrtb_85
Value: AAD8LE7JJAMAAB-Q-u4sFQ
.simpli.fi/ Name: suid
Value: FCA67877EA764E1F821EE4EC1A0C959E
.lijit.com/ Name: _ljtrtb_87
Value: 967ba71f-887a-40cd-a2cb-fd1cbcd221c2
.dlx.addthis.com/ Name: na_sc_x
Value: 1
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 6810-59f17c06-c5d2-4b1e-89aa-3d64ff091022&KRTB&22918-59f17c06-c5d2-4b1e-89aa-3d64ff091022&KRTB&22926-59f17c06-c5d2-4b1e-89aa-3d64ff091022&KRTB&23031-59f17c06-c5d2-4b1e-89aa-3d64ff091022
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 22987-CAESECwE4banhqfisdfFzHL7LsM&KRTB&16514-CAESECwE4banhqfisdfFzHL7LsM&KRTB&23025-CAESECwE4banhqfisdfFzHL7LsM&KRTB&23386-CAESECwE4banhqfisdfFzHL7LsM
.pubmatic.com/ Name: KRTBCOOKIE_22
Value: 14911-8301830339311477822&KRTB&23150-8301830339311477822
.pubmatic.com/ Name: KRTBCOOKIE_148
Value: 19421-uid:FCA67877EA764E1F821EE4EC1A0C959E&KRTB&23489-uid:FCA67877EA764E1F821EE4EC1A0C959E
.thrtle.com/ Name: mc
Value: eyJpZCI6Ijc5YTAwNTIzLWQ3ZjYtNDY1My1iZWM3LTM3MTVmZmM5NGIyOCIsImwiOjE2ODcyOTAyNDQ1OTIsInQiOjF9
.smaato.net/ Name: SCMo
Value: 95cec808
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005%22%7D
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value: 1!4123-2!4123
.ads.yieldmo.com/ Name: ptrunl
Value: RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
.lijit.com/ Name: ljtrtb
Value: eJwVyk8LgjAYgPHvsnMvuLV8V7dFSzYUFPOQt%2F1hUoaSEgTRd29dn9%2FzISIjB1IaXtOqLoAqKHTRkQ0Ru9SlPIlSoTGykvIIDbz4em7%2Bikn3OTqLNIIQaIFnPoBl3kEM1DsfGKOepZdv07u%2Bh%2BHuuqCv%2BXxpp56rMWOLMVHf5nZa%2BnV8YqsflHx%2Fzx8onw%3D%3D
.lijit.com/ Name: _ljtrtb_42
Value: cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701
.mfadsrvr.com/ Name: ssh
Value: !taboola,1687290244!sovrn,1687290244
pool.admedo.com/ Name: tuuid
Value: 0443731d-ef67-4c6c-86ad-2109fa610bab
pool.admedo.com/ Name: c
Value: 1687290244
.rfihub.com/ Name: euds
Value: H4sIAAAAAAAA_wXBwRGAMAgEwI_t4AQSOLAbkKEQK3f3u-A9XgmlnCw69QolrKkDwb7Hl-bD5pBYcvYdbGqKH_Te9XM6AAAA
.adscale.de/ Name: uu
Value: 7e7e6a26c4614795a39d50bb401edffb
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAA_-MSsjSzMDAzsjC2MLY0Nre0NDU0FOIz1HU2NooKNMq3dDLwMwAAurLUHiQAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAA_-MSsjSzMDAzsjC2MLY0Nre0NDU0FOIz1HU2NooKNMq3dDLwMwAAurLUHiQAAAA
live.rezync.com/ Name: sd-session-id
Value: .eJwNykEOgyAQAMC_7FkaYIXd5TMGBBLSShuxlxr_Xo-TzAnLp-xb7KUfEI79WyZYX-3WgHDCaL-tPCGAeNbeMjIKkoh2CNcEo4zR3n1p-S6cK6dITsUak5rTalUkn1UWEsNYWbsYjGeyou2MDzHeeUdw_QG5NiYj.ZJIBhQ.gX4YWFvYhuqhV_USz67kgzIOeDY
pool.admedo.com/ Name: tuuid_lu
Value: 1687290245
.adscale.de/ Name: cct
Value: 1687290245294
.id5-sync.com/ Name: id5
Value: 236e2704-c0c0-7841-8d24-fdcbf12721fb#1687290245215#2
.adx.opera.com/ Name: UID
Value: OPU05e78a85863e483c8e7c951508b1240d
.mercurynews.com/ Name: _pnlspid
Value: 10402
.mercurynews.com/ Name: _pnss
Value: dismissed
.mercurynews.com/ Name: _pnpdm
Value: true
.id5-sync.com/ Name: cf
Value:
.id5-sync.com/ Name: cip
Value:
.id5-sync.com/ Name: cnac
Value:
.id5-sync.com/ Name: car
Value:
.id5-sync.com/ Name: gdpr
Value:
.go.sonobi.com/ Name: HAPLB8S
Value: s8583|ZJIBi
.smartadserver.com/ Name: vs
Value: 563381=5504864
.smartadserver.com/ Name: sasd2
Value: q=%24qc%3D1308948106%3B%24ql%3DHigh%3B%24qpc%3D28700%3B%24qt%3D124_1509_77271t%3B%24dma%3D0&c=1&l=1501522464&lo=384595258&lt=638228870461456394&o=1
.smartadserver.com/ Name: sasd
Value: %24qc%3D1308948106%3B%24ql%3DHigh%3B%24qpc%3D28700%3B%24qt%3D124_1509_77271t%3B%24dma%3D0
.ads.yieldmo.com/ Name: consentt
Value: 1
.ads.yieldmo.com/ Name: rptr
Value: unl%3D1688499360000%7Cc%3D1688499360000%7Ct%3D1172569%7Ctapad%3D1688499360000%7Cpub%3D1688499360000%7Can%3D1688499360000
.mercurynews.com/ Name: anonDeviceId
Value: b703beb6a13d3dbad7335e1ae9a1af96
.ads.yieldmo.com/ Name: ptrt
Value: 59f17c06-c5d2-4b1e-89aa-3d64ff091022
.adnxs.com/ Name: icu
Value: ChgIiNJ7EAoYAyADKAMwhoPIpAY4A0ADSAMKGQipr4gBEAoYASABKAEwhIPIpAY4AUABSAEKGQiYrooBEAoYASABKAEwgYPIpAY4AUABSAEQhoPIpAYYBA..
.deepintent.com/ Name: CDIPARTNERS
Value: %7B%22141%22%3A%2220230620%22%7D
.dotomi.com/ Name: DotomiTest
Value: d50e1659d250559
.pubmatic.com/ Name: KRTBCOOKIE_18
Value: 22947-968062838393799511
.pubmatic.com/ Name: KRTBCOOKIE_1251
Value: 23269-di_997d12a216e84889bc024
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:c0d66492-0183-4f00-930f-e67415c7188d&KRTB&16736-uid:c0d66492-0183-4f00-930f-e67415c7188d&KRTB&23019-uid:c0d66492-0183-4f00-930f-e67415c7188d&KRTB&23114-uid:c0d66492-0183-4f00-930f-e67415c7188d
.pubmatic.com/ Name: KRTBCOOKIE_57
Value: 22776-1179662177681492769&KRTB&23339-1179662177681492769
.pubmatic.com/ Name: KRTBCOOKIE_279
Value: 22890-880a98a2-e5e4-4836-b912-8db1e124443a&KRTB&23011-880a98a2-e5e4-4836-b912-8db1e124443a&KRTB&23355-880a98a2-e5e4-4836-b912-8db1e124443a
.contextweb.com/ Name: pb_rtb_ev
Value: 3-1l9q|4is.0.CAESEGPuUHjqtKix2YVOu27mPRk|7TY.0|2N.0.AAAHwrPka_LWIgNQwSkJAAAAAAA|3oy.0|7bq.0.1|5Ql.0.cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701|7dN.0.AAD8LE7JJAMAAB-Q-u4sFQ
.bfmio.com/ Name: __187_cid
Value: 8E87CD5E-E863-49F4-8101-49E63E3D4BD9
.bfmio.com/ Name: __io_cid
Value: 4ada6e1fd2281cc16ba3ebc5bcf4bbee6cd9a345
.semasio.net/ Name: SEUNCY
Value: 7D6AE0D8CA7C0A32
.pubmatic.com/ Name: KRTBCOOKIE_32
Value: 11175-AAACG66zQrHM8QMaOwzmAAAAAAA&KRTB&22713-AAACG66zQrHM8QMaOwzmAAAAAAA&KRTB&22715-AAACG66zQrHM8QMaOwzmAAAAAAA
.server.cpmstar.com/ Name: USER_ID
Value: %84*%c6%e8%0d2%06%15X%b2%de%a2%cbB%3f
.pubmatic.com/ Name: KRTBCOOKIE_699
Value: 22727-AAD8LE7JJAMAAB-Q-u4sFQ
.mxptint.net/ Name: mxpim
Value: R33647_1049454A6_B75A6C7A.1.000000000000000064920187
.pubmatic.com/ Name: KRTBCOOKIE_188
Value: 3189-e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341&KRTB&23418-e1133e9b-79ec-4417-a46d-cc5a4e9307a9-64920180-4341
.pubmatic.com/ Name: KRTBCOOKIE_466
Value: 16530-b906d225-1d58-4500-8893-66f3b5de01e6
.id5-sync.com/ Name: 3pi
Value: 464#1687290245438#1669341548#cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701|112#1687290247805#-655440719#7D6AE0D8CA7C0A32|434#1687290246110#2011560749|2#1687290247173#667813819#1179662177681492769|3#1687290248739#-1913570315#c0d66492-0183-4f00-930f-e67415c7188d|264#1687290245853#486503993#59f17c06-c5d2-4b1e-89aa-3d64ff091022|441#1687290246585#-1563179279#u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09|429#1687290248344#454406850#8E87CD5E-E863-49F4-8101-49E63E3D4BD9
.id5-sync.com/ Name: callback
Value:
.sojern.com/ Name: gid
Value: CAESELoCfF1wTY3vred3XwfrqLg
.sojern.com/ Name: cid
Value: 8b4a22cb-1b30-377d-a4ee-e16e96c200e7#1687219200000
.www.mercurynews.com/ Name: sub_nxt_upd_ac_DFM_BANGWPPRODWAB_PROD
Value: 1
.www.mercurynews.com/ Name: sub_nxt_DFM_BANGWPPRODWAB_PROD
Value: {%222%22:{%22104000%22:{%22ac%22:1%2C%22ac_d%22:1%2C%22s%22:1687290249834}%2C%22104103%22:{%22ac%22:0%2C%22ac_d%22:0%2C%22s%22:1687290249742}%2C%22_ac_d%22:1%2C%22_ac%22:1%2C%22_acnv%22:%22104000%22}}
.omnitagjs.com/ Name: ayl_visitor
Value: d32ed1d1d06612715aa282670b9dccf4
.adstanding.com/ Name: _adstanding_id
Value: 4cb975a7186b097f02ae275c059e0902
.pubmatic.com/ Name: SyncRTB3
Value: 1689811200%3A224%7C1688428800%3A21_176_243_81_250_22_238_71_54_3_214_239_46_220_8_165_240_99_204_104_231_5_249_96_13_7_233_234_56_166_48_178_55%7C1687824000%3A15_38_223_2%7C1692403200%3A69%7C1688083200%3A63%7C1688515200%3A35
.nrich.ai/ Name: _nauid
Value: cf778d1d-d203-4e00-b50f-6457d4a0869b
.quantserve.com/ Name: d
Value: ELUBGAGjKfijDejbEKj6EA
.pubmatic.com/ Name: KRTBCOOKIE_153
Value: 1923-zF7KIcpbyyLXC8N1nw_eds0PliTXDJB1zQzLDEcp&KRTB&19420-zF7KIcpbyyLXC8N1nw_eds0PliTXDJB1zQzLDEcp&KRTB&22979-zF7KIcpbyyLXC8N1nw_eds0PliTXDJB1zQzLDEcp&KRTB&23462-zF7KIcpbyyLXC8N1nw_eds0PliTXDJB1zQzLDEcp
.pubmatic.com/ Name: KRTBCOOKIE_1278
Value: 23329-50113f91-7ace-4204-934b-46770b6d07a4&KRTB&23340-50113f91-7ace-4204-934b-46770b6d07a4&KRTB&23498-50113f91-7ace-4204-934b-46770b6d07a4
.pubmatic.com/ Name: KRTBCOOKIE_860
Value: 16335-cuj0HMYUXER6RDS6pY-AEJU4mbI&KRTB&23334-cuj0HMYUXER6RDS6pY-AEJU4mbI&KRTB&23417-cuj0HMYUXER6RDS6pY-AEJU4mbI&KRTB&23426-cuj0HMYUXER6RDS6pY-AEJU4mbI
beacon.lynx.cognitivlabs.com/ Name: ss
Value: 6emVOn1cYVF15KEdKiUGRviLFef1xN6jxYmUSCLHyAKk1ET10Qv3yVzxjL4v1JtkiZEoIPsGKDcXmJCHfsebsFLpv%2Bqo8tosFg3ipECq%2FTA%3D
.adgrx.com/ Name: ADGRX_UID
Value: d47e24dc-0fa2-11ee-ac94-72b4b480830c
.acuityplatform.com/ Name: auid
Value: 792501171541
.acuityplatform.com/ Name: aum
Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqANvqNdXNlck1hdGNoaW5nSWTMkWxhc3REcm9wVGltZU1pbGxpcyUBRDZKYFSemGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUQ2SmBUno90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="
.w55c.net/ Name: wfivefivec
Value: NWVHfDIW1QbHgT5
.ctnsnet.com/ Name: cid_7dbbf0ab49b44281ad32239b384e8cbf
Value: 1
ads.playground.xyz/ Name: connect.sid
Value: s%3ArCfxZksi2oAtOFFhj-0wXZ2Fp9tfaago.oNrEMmetY7blJkKPXPtwz24qJ0PQ64s8xjJFJPjtt5I
.adgrx.com/ Name: ADGRX_CM_PUBMATIC_BRIDGED
Value: 1
.tribalfusion.com/ Name: ANON_ID
Value: annufroZdUQdR2Hp9v8g6WG4syIsLt8l3ilUFb7wDqk5bABYErIR8UdUKQE7pUrMZbHEWXyhl9PiGfSZce39NHFQLYwKSRtOZcxWQJbemASq
.pubmatic.com/ Name: KRTBCOOKIE_469
Value: 8273-792501171541&KRTB&23428-792501171541
.pubmatic.com/ Name: KRTBCOOKIE_1305
Value: 23413-8E87CD5E-E863-49F4-8101-49E63E3D4BD9&KRTB&23479-8E87CD5E-E863-49F4-8101-49E63E3D4BD9&KRTB&23408-8E87CD5E-E863-49F4-8101-49E63E3D4BD9
.w55c.net/ Name: matchpubmatic
Value: 5
.pubmatic.com/ Name: KRTBCOOKIE_1003
Value: 22761-d47e24dc-0fa2-11ee-ac94-72b4b480830c&KRTB&23275-d47e24dc-0fa2-11ee-ac94-72b4b480830c
.pubmatic.com/ Name: KRTBCOOKIE_594
Value: 17105-RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005&KRTB&17107-RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005
.pubmatic.com/ Name: KRTBCOOKIE_107
Value: 1471-uid:NWVHfDIW1QbHgT5&KRTB&23421-uid:NWVHfDIW1QbHgT5
.adform.net/ Name: C
Value: 1
.inmobi.com/ Name: idsp_c
Value: a457c9e9-2914-4c4f-865e-b60bc0f898f7
.pippio.com/ Name: did
Value: nyJsMo-KW76p5AfC
.pippio.com/ Name: didts
Value: 1687290252
.pippio.com/ Name: nnls
Value:
.adform.net/ Name: uid
Value: 1598040676591792150
.owneriq.net/ Name: p2
Value: pmc
.owneriq.net/ Name: si
Value: Q7405766521439522184P
.owneriq.net/ Name: pmc
Value: 1
.adsby.bidtheatre.com/ Name: __kuid
Value: 59a5b5f7-4084-4fca-af03-1a5d040bf2c3.456504252
.mercurynews.com/ Name: _ml_id
Value: ba10b823-5015-4d9c-bc8f-648a9ff50d11.1687290242.1.1687290252.1687290242
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-1598040676591792150&KRTB&23263-1598040676591792150&KRTB&23481-1598040676591792150
.betweendigital.com/ Name: dc
Value: was1
.betweendigital.com/ Name: tuuid
Value: 2f81eaed-0776-53ab-ae15-6ab4ca876b38
.betweendigital.com/ Name: ss
Value: 1
.richaudience.com/ Name: pdid
Value: f6146743-46db-4d85-a9f2-1zz1687290251
.c.appier.net/ Name: _auid
Value: eTsnmm5VDg6trxz8jAGSZA
.pubmatic.com/ Name: KRTBCOOKIE_904
Value: 16787-eTsnmm5VDg6trxz8jAGSZA
.pubmatic.com/ Name: PugT
Value: 1687283673
.us.ck-ie.com/ Name: CID
Value: 735c76c17fa5a74bf8d4338effe465407d59f987
.pippio.com/ Name: pxrc
Value: CIyDyKQGEgQIAhAAEgYI7OsBEAA=
.smartadserver.com/ Name: TestIfCookieP
Value: ok
.smartadserver.com/ Name: pbw
Value: %24b%3d16999%3b%24o%3d11100
.rqtrk.eu/ Name: browser_id
Value: 1:7155e002-781f-48f6-b91a-2e4b012c3c63
.richaudience.com/ Name: avcid-sma-uid
Value: 4614819635623485669
.linksynergy.com/ Name: rmuid
Value: 403238cf-5851-423a-9dbf-f9cc07c258c7
.linksynergy.com/ Name: icts
Value: 2023-06-20T19:44:13Z
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-64d977bf-a2a9-423a-8d0b-404f4e0c5937-005%22%2C%22nxtrdr%22%3Afalse%7D
.pubmatic.com/ Name: SPugT
Value: 1687290253
match.sharethrough.com/ Name: AWSALBCORS
Value: nc10eLZuX4eg4NQUwjSWXZ5xNKZMtqiCyDoR3903qxtuku3UUBcZvlAH6QjaSPo+uiGI64s02rNzsl84iok6N7i2e+10ieg7Io7Nlp4wPJhzip4BHwcCtfQXDPAn
.mercurynews.com/ Name: _fbp
Value: fb.1.1687290254663.394908289
.mercurynews.com/ Name: calltrk_referrer
Value: direct
.mercurynews.com/ Name: calltrk_landing
Value: https%3A//www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
.krxd.net/ Name: _kuid_
Value: PoI5Jiuk
.creative-serving.com/ Name: tuuid
Value: 9196abb7-eff9-418f-8017-c9ef56d86182
.creative-serving.com/ Name: c
Value: 1687290254
.mercurynews.com/ Name: _uetsid
Value: d639d7d00fa211ee9038392b1d067fe6
.mercurynews.com/ Name: _uetvid
Value: d63a30a00fa211eebec3330b972ab9e6
.bing.com/ Name: MUID
Value: 31353F47B9786A2B171E2C71B8AE6B0F
.bat.bing.com/ Name: MR
Value: 0
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 11
.pubmatic.com/ Name: DPSync3
Value: 1687824000%3A253_252_248%7C1688256000%3A257%7C1688428800%3A255_261_258_226_235_197_228_256_263_245_262_219_201_236_260_259
.creative-serving.com/ Name: tuuid_lu
Value: 1687290255
.ads.pubmatic.com/ Name: pubsyncexp
Value: 1687311855240
.mercurynews.com/ Name: cto_bundle
Value: QT01A19LTUhQb0J2ZFduR0tJWlp1Z24wJTJCRTB0dkxXZkQ3Z2lOMEk2NWpuc2tBVUFOODRWUXhOeEZSSWowNnpjenUyR0RzdDU5R2FoQ2tqRnhxT1BueGFvNGFuQmlSVUFCTlNJbFFWaVRNT0c2Nmh6RkFQYktVV2prMjVic2FlT3JjUnFMblJ2MGpsNzg0OHVMNjhpYlZONVpxdyUzRCUzRA
.agkn.com/ Name: ab
Value: 0001%3AFGk5PGfB8E6RPcVfdzKjUQcTAE8ItstV
io.narrative.io/ Name: io.narrative.guid.v2
Value: d68568d0-0fa2-11ee-b479-0e71178f036d
.audrte.com/ Name: arcki2
Value: g27DNruJcT-SvqLwG1NjEg-yQ!20220908!1687290255319!ip#149.56.153.178
.audrte.com/ Name: arcki2_pubmatic
Value: 8E87CD5E-E863-49F4-8101-49E63E3D4BD9!20220908!1687290255322
.audrte.com/ Name: arcki2_ddp2
Value: g27DNruJcT-SvqLwG1NjEg-yQ!20220908!1687290255442
.audrte.com/ Name: arcki2_adform
Value: 1598040676591792150!20220908!1687290255514
.smartadserver.com/ Name: csync
Value: 22:1598040676591792150|31:b906d225-1d58-4500-8893-66f3b5de01e6|75:59f17c06-c5d2-4b1e-89aa-3d64ff091022|76:CAESEMCO8RRcAPIm0NK8XFQn0YM|91:8E87CD5E-E863-49F4-8101-49E63E3D4BD9|107:cd913cc4-1f2c-4af7-8399-e2f5db539f03-tuctb8b8701|116:7dYANMJyrp6NSRwK_hfM|117:d32ed1d1d06612715aa282670b9dccf4|124:8681e833-58ee-4151-9960-f1e5bdda03d8|127:AAD8LE7JJAMAAB-Q-u4sFQ|134:OB_OK|135:TAM_OK|139:0|141:g27DNruJcT-SvqLwG1NjEg-yQ|147:35620282-96f1-466f-b370-6daf818c9a83|150:0
.onaudience.com/ Name: cookie
Value: d2a6ca27ac73d20d
.onaudience.com/ Name: done_redirects161
Value: 1
.audrte.com/ Name: arcki2_smart
Value: 4614819635623485669!20220908!1687290255716
.betweendigital.com/ Name: ut
Value: ZJIBjwAOY5gkEcvqrSgQV835OPoylkoTGvM-_g==
.connectad.io/ Name: uid
Value: VntTIJIzPmps6mhFr7oxXJLfSSsqnyaeq3Hhh7Sy
.onaudience.com/ Name: done_redirects104
Value: 1
.adnxs.com/ Name: anj
Value: dTM7k!M4.FEVNsVF']wIg2HbX5[8uF8XgkLA=)RM*f=k`tNsy#O]E9)g^t0OT3yr_=J_xoRHe`f2GM6oT3ysDTPKa]T:6Y-#]_)zAQhI%>wL5L!!+_**ia6(
.adnxs.com/ Name: uids
Value: eyJ0ZW1wVUlEcyI6eyJzbWlsZXdhbnRlZCI6eyJ1aWQiOiI3ZGE0YmY4ZDUxMzEyZWUwOGY1ZGJmOTNjZmJjYjBiOSIsImV4cGlyZXMiOiIyMDIzLTA5LTE4VDE5OjQ0OjE2WiJ9fSwiYmlydGhkYXkiOiIyMDIzLTA2LTIwVDE5OjQ0OjE1WiJ9
.mookie1.com/ Name: id
Value: 10599714307805270596
.mookie1.com/ Name: mdata
Value: 1|10599714307805270596|1687290256326
.mookie1.com/ Name: ov
Value: 63d873223b748c72bb4b8769fd7ac36c
.onaudience.com/ Name: done_redirects109
Value: 1
.rubiconproject.com/ Name: audit
Value: 1|clb2f5t+FPqx671UofVeNu1WuCoMxA8a+JUixCbOKdqHbG77vviNX0TSkrYZrsYaemRQpco3Y9lVQ4XeDu51Hj79QniQXr/U4WXUF1ge4XjTiK5tDBF3EN1PNrebWf4YpmvllXEtYN4=
.smilewanted.com/ Name: sw_user_params_infos
Value: WvVw1ECedCeDmNavDAL6DXNZBDkuwxR%2B2FemzYFoN0VhWpdRypNLDg0lHTz45LSZqtsCLHTbGRVggwIALClfP%2FqoS1jJsKP0mocxZPq6LdIgT61DryhUj5fa70r045U03mFP95Aes9LktWZPzW1FDKgbZhabik6uGD%2F%2BwtYvQQ87dyEIJYfQRZRl6UV7buhccy2VI4AedyshCLihif08jhCm%2Bhv4BdiSxC%2BBawoOYWz6E4wWpoL7gZPHcUAuSwMxzTbbJwmhIXmcExw1xQF48di27XETCdNtxMPitpxkwjHoNPj3AIUE%2BXivjmfBF2233uThLYsOcZ0E%2FuUBOzztwd5XbtXgA4V6M8fMGNeE56dnbvA6rohKHO5zFCPhN4RNbmJLX4qetKFf8Ir%2B7vxojR6A1FX%2B4ThFWKNuR6eMgG5cEPwLJF0c1eyvaVWICF6zdpUMP9LPgmHLlhVj95TwMzdLMOz5au7st55yVA0rDgiWIrtK%2F527fYgdtR9Vd45EPZQuTDwNP%2BnNuS9RFV%2FWlRlnlvmEiPoMIEfxwa6AeD72206IGnV9NPASQiSIx2vaO4Ri8SMxBS%2F%2BeE4x7JQkXTWpcLNtWkTIZruR%2B79nVMBWACz9EOTzzAClZfO0Uc6Yujj%2FGnB7ngQjg8JXfgfi9gqr3pIxNzCVqr62dfm703zMSe0WPWfQbaXEZ9uhlQ907iapimjoWrPKae6qPTJdnw%3D%3D
ads.avct.cloud/ Name: uuid
Value: 620af48c-687b-4acd-b194-f908d727b4e1
.openx.net/ Name: pd
Value: v2|1687290256|iKbwuYvPvMgahEgKkWg2f8gy
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAA_9vEyGtoZmFuZGlgZGJubGnwC8E3NbMwMlrFgpA3NTI0AAAd8XYmMAAAAA
.analytics.yahoo.com/ Name: IDSYNC
Value: "19c8~2cbv:18z8~2cbv:175w~2cbv:18za~2cbv"
.sitescout.com/ Name: _ssuma
Value: eyI3NyI6MTY4NzI5MDI0NTAzOSwiMzQiOjE2ODcyOTAyNDA3NDcsIjQ1IjoxNjg3MjkwMjQ3ODQxLCIyIjoxNjg3MjkwMjQwNzQ3LCIyNCI6MTY4NzI5MDI0NjU2OSwiNCI6MTY4NzI5MDI0MDc0NywiMzkiOjE2ODcyOTAyNDA3NDcsIjE3IjoxNjg3MjkwMjU2ODkxLCI3IjoxNjg3MjkwMjQwNzQ3fQ
.brand-display.com/ Name: _knxq_
Value: dd8be30d-cfe6-0402-a26c293a.1687290256.0.1687290256.1687290256
.adsrvr.org/ Name: TDCPM
Value: CAESGwoMc2hhcmV0aHJvdWdoEgsI9L_Yv5f0-DsQBRIUCgV0YXBhZBILCNKL77-X9Pg7EAUSGQoKbGl2ZWludGVudBILCIaLycSX9Pg7EAUSFgoHcnViaWNvbhILCN6N2MWX9Pg7EAUSEgoDYWFtEgsItpu6yN7B7TsQBRITCgRrcnV4EgsI1OzCyd7B7TsQBRIVCgZnb29nbGUSCwjKw7W8mPT4OxAFEhcKCGFwcG5leHVzEgsIstrQvZj0-DsQBRIWCgdibHVla2FpEgsIstrQvZj0-DsQBRgFOAFCBCICCAE.
.rlcdn.com/ Name: pxrc
Value: CIWDyKQGEgUI6AcQABIFCOhHEAYSBgi66gEQABIGCLjrARAL
.taptapnetworks.com/ Name: SONATA_ID
Value: csonata_027c9f7f-9cca-4583-8476-8ba6a3d62fc9
.rlcdn.com/ Name: rlas3
Value: Idau43FsmX8X5FbMA5thZXFAAeiyKTl51e+AsIgUlXk=
.connectad.io/ Name: id
Value: eyJpdiI6IjN0UHNibHVaeGVDNzhiT3M4c3hRdEE9PSIsInZhbHVlIjoibys3bXhCZjZmSXRMQ1BJS1JZQVluOWNwVHBTcTZWQnlPY3liR0xkNjRQU2g1N0c5YVZra1hMdVBzUTVBcUp0akVKZnRYdWpEQ3hiUHRvbVQyUEJvTE5GV3NmQ0Juano1UzdSMXpzWVU3bjMzeTdlckM5V1pDaHQwald4dCsxbmczeWZ6b0lTZVRDZEJOSE1Dc0EzV2ZVSFR1V1Q0SXNuY2Z2NW1RMkdIUjR3Mzg4STMwMkdIellaQXZDQmRCTlNsTVZmRlNhVWFnYXhRc1IweGFOUG9WUzcycnNFNk8yeTE2VnlCdzczMU5Jaz0iLCJtYWMiOiJjM2IxOTQ1Y2YyY2I4MzVhODgxMTFmODgxNmE4ZDgxNjFjYmRhZTE2YmM2NzU4NWJhMjc3NTBlNjliYjEzNzI3In0%3D

42 Console Messages

Source Level URL
Text
javascript warning URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js(Line 1)
Message:
Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
network error URL: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=
Message:
Failed to load resource: the server responded with a status of 400 (Bad Request)
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
network error URL: https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_a4a22c63-0349-4c86-8ae8-95ec6c33fb09&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33647_1049454A6_B75A6C7A&r=https://pmp.mxptint.net/sn.ashx?ak=1
Message:
Failed to load resource: the server responded with a status of 502 ()
javascript error URL: https://8proof.com/app/rtbmarkup/5111?id=515456897218&ctd=110096&crid=1178&ap=ZJIBiAAKoMUKcQhIAAXjoCOFh5lBP83h-39-qg
Message:
Access to font at 'https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-600.woff2' from origin 'https://8proof.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-600.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://8proof.com/app/rtbmarkup/5111?id=515456897218&ctd=110096&crid=1178&ap=ZJIBiAAKoMUKcQhIAAXjoCOFh5lBP83h-39-qg
Message:
Access to font at 'https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-800.woff2' from origin 'https://8proof.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-800.woff2
Message:
Failed to load resource: net::ERR_FAILED
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

79049f8a26749af8c4bb3f360ebceb58.safeframe.googlesyndication.com
7e57588ba814e3699bc2c083d65eb8fe.safeframe.googlesyndication.com
8proof.com
a.audrte.com
a.tribalfusion.com
a869.mercurynews.com
aa.agkn.com
aax-eu.amazon-adsystem.com
aax.amazon-adsystem.com
accounts.google.com
acdn.adnxs-simple.com
acdn.adnxs.com
ad.360yield.com
ad.doubleclick.net
ad.mrtnsvr.com
ad.turn.com
ade.googlesyndication.com
ads.avct.cloud
ads.betweendigital.com
ads.creative-serving.com
ads.playground.xyz
ads.pubmatic.com
ads.stickyadstv.com
ads.yieldmo.com
adservice.google.com
adx.adform.net
ajax.googleapis.com
amazon-tam-match.dotomi.com
ams-pageview-public.s3.amazonaws.com
ap.lijit.com
api-mg2.db-ip.com
api.viafoura.co
az416426.vo.msecnd.net
b-code.liadm.com
b1sync.zemanta.com
bat.bing.com
bcp.crwdcntrl.net
beacon.krxd.net
beacon.lynx.cognitivlabs.com
beacon.sojern.com
bh.contextweb.com
bidder.criteo.com
bpi.rtactivate.com
c.amazon-adsystem.com
c1.adform.net
casale-match.dotomi.com
cdn.8proof.com
cdn.adnxs.com
cdn.auth0.com
cdn.callrail.com
cdn.confiant-integrations.net
cdn.connectad.io
cdn.czx5eyk0exbhwp43ya.biz
cdn.doubleverify.com
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.jwplayer.com
cdn.p-n.io
cdn.parsely.com
cdn.pranmcpkx.com
cdn.prod.uidapi.com
cdn.taboola.com
cdn.viafoura.net
cds.taboola.com
ce.lijit.com
choices.trustarc.com
choices.truste.com
cm.adform.net
cm.adgrx.com
cm.g.doubleclick.net
cmp.osano.com
cms.quantserve.com
connect.facebook.net
consent.api.osano.com
contextual.media.net
core.iprom.net
crb.kargo.com
crcdn01.adnxs-simple.com
creativecdn.com
cs-server-s2s.yellowblue.io
cs.admanmedia.com
cs.iqzone.com
cs.media.net
cs.yellowblue.io
csync.loopme.me
csync.smilewanted.com
d.turn.com
dc.services.visualstudio.com
digitalfirstmedia.blueconic.net
dis.criteo.com
dmp.adform.net
dmp.brand-display.com
dpm.demdex.net
dsp.nrich.ai
dsum-sec.casalemedia.com
dsum.casalemedia.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
geo.privacymanager.io
gocm.c.appier.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
hb.adpone.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
htlbid.com
i.clean.gg
i.liadm.com
i.viafoura.co
i6.liadm.com
ib.adnxs.com
ice.360yield.com
id.rlcdn.com
id5-sync.com
idsync.rlcdn.com
ih.adscale.de
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
image8.pubmatic.com
images.taboola.com
imprnjmp.taboola.com
insight.adsrvr.org
io.narrative.io
ipac.ctnsnet.com
jadserve.postrelease.com
js.matheranalytics.com
js.moatads.com
k.p-n.io
launchpad-wrapper.privacymanager.io
launchpad.privacymanager.io
live.rezync.com
load77.exelator.com
loada.exelator.com
loader-cdn.azureedge.net
loadm.exelator.com
maps.googleapis.com
match.adsby.bidtheatre.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
match.taboola.com
matching.truffle.bid
mug.criteo.com
mweb.ck.inmobi.com
nym1-ib.adnxs.com
odr.mookie1.com
onetag-sys.com
p.rfihub.com
p1.parsely.com
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
pippio.com
pips.taboola.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.onaudience.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.sitescout.com
pixel.sojern.com
pixel.tapad.com
pixel.wp.com
player-files.remixd.com
pm-widget.taboola.com
pm.w55c.net
pmp.mxptint.net
polyfill.io
pool.admedo.com
pr-bh.ybp.yahoo.com
prebid.smilewanted.com
prg.smartadserver.com
prod-dfm-proxy-connext.azurewebsites.net
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev
prodmg2.blob.core.windows.net
protected-by.clarium.io
pubcast-files.remixd.com
pubmatic-match.dotomi.com
pulsepoint-match.dotomi.com
px.owneriq.net
r.casalemedia.com
rp.liadm.com
rp4.liadm.com
rtb-csync.smartadserver.com
rtb.adentifi.com
rtb.adstanding.com
rtb.gumgum.com
rtb.mfadsrvr.com
rules.quantcount.com
s.ad.smaato.net
s.amazon-adsystem.com
s.btstatic.com
s.ntv.io
s.thebrighttag.com
s.tribalfusion.com
s.w.org
s0.2mdn.net
sb.scorecardresearch.com
secure-assets.rubiconproject.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
server.cpmstar.com
session.mercurynews.com
simage2.pubmatic.com
simage4.pubmatic.com
sli.mercurynews.com
sonata-notifications.taptapnetworks.com
sopalk.com
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
ssc-cms.33across.com
ssl.connextra.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
stags.bluekai.com
static.criteo.net
static.smilewanted.com
stats.g.doubleclick.net
stats.wp.com
sync-amz.ads.yieldmo.com
sync-eu.connectad.io
sync-t1.taboola.com
sync-tm.everesttech.net
sync.1rx.io
sync.adkernel.com
sync.bfmio.com
sync.connectad.io
sync.crwdcntrl.net
sync.go.sonobi.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.richaudience.com
sync.smartadserver.com
sync.srv.stackadapt.com
sync.taboola.com
sync.targeting.unrulymedia.com
sync.teads.tv
sync.technoratimedia.com
synchroscript.deliveryengine.adswizz.com
t.adx.opera.com
tags.bluekai.com
tags.rd.linksynergy.com
tags.remixd.com
tg.socdm.com
thrtle.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
tps.doubleverify.com
tpsc-ue1.doubleverify.com
tr.blismedia.com
trace.mediago.io
trc.taboola.com
u.openx.net
uipglob.semasio.net
um.simpli.fi
ums.acuityplatform.com
unpkg.com
ups.analytics.yahoo.com
us-match.taboola.com
us-trc-events.taboola.com
us-u.openx.net
us-vid-events.taboola.com
us.ck-ie.com
usermatch.krxd.net
usersync.gumgum.com
vidstat.taboola.com
visitor.omnitagjs.com
wt.rqtrk.eu
www.facebook.com
www.foo.software
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.i.matheranalytics.com
www.mercurynews.com
x.bidswitch.net
x.dlx.addthis.com
cdn.8proof.com
fastlane.rubiconproject.com
protected-by.clarium.io
104.102.111.7
104.18.25.185
104.22.68.131
104.26.5.15
104.36.115.111
104.69.48.172
104.91.103.236
107.178.244.119
107.178.250.234
107.178.254.65
108.138.106.40
108.138.106.60
108.138.107.138
108.139.47.67
124.146.215.48
13.225.214.63
13.225.214.90
13.33.60.24
13.35.93.23
13.35.93.31
13.85.16.224
137.184.240.117
141.226.224.32
141.226.224.48
141.94.171.213
141.95.98.64
142.250.176.194
142.250.65.230
142.251.35.162
143.204.146.37
15.235.42.103
151.101.1.108
151.101.130.49
151.101.193.44
162.248.18.32
162.248.18.34
162.55.120.196
167.235.114.248
169.197.150.8
172.105.221.29
172.217.13.98
174.137.133.32
18.164.101.60
18.164.116.116
18.164.116.119
18.164.96.113
18.164.98.157
184.27.80.19
185.167.164.49
185.184.8.90
188.166.17.21
192.0.66.2
192.0.76.3
192.0.77.48
192.40.39.223
195.244.31.10
195.5.165.20
198.148.27.140
198.24.170.28
199.127.204.142
199.38.167.130
20.60.62.4
20.85.134.6
204.2.226.29
207.198.113.205
207.198.113.86
23.105.12.137
23.105.12.145
23.105.14.100
23.105.14.106
23.192.32.8
23.20.148.40
23.200.197.46
23.215.40.23
23.33.238.169
23.36.204.23
23.37.104.225
23.44.133.31
23.54.68.184
23.54.68.197
23.54.69.53
2600:1400:9000::6875:b641
2600:1f18:44f0:4850:e869:190e:35cd:331e
2600:1f18:4e9:5a07:b5c0:eead:85e9:361a
2600:1f18:730:b120:94f1:b451:8dad:7124
2600:1f18:ed:550e:ae88:c386:1391:2528
2600:9000:21dd:7800:8:2ae1:d740:93a1
2600:9000:21dd:a600:6:44e3:f8c0:93a1
2600:9000:2209:4400:1:a3fa:7cc0:93a1
2600:9000:2209:5400:1b:5138:8a40:93a1
2600:9000:23cb:9a00:8:8845:1500:93a1
2600:9000:2510:2e00:3:b7e:8940:93a1
2600:9000:2511:6e00:a:e047:753:be1
2600:9000:2511:fc00:10:474e:104a:2961
2602:803:c002:200::116
2603:c020:400d:3000:f50:982a:7877:65bd
2606:2800:11f:17a5:191a:18d5:537:22f9
2606:2800:11f:1cb7:261b:1f9c:2074:3c
2606:4700:10::6816:36ce
2606:4700:10::ac43:266a
2606:4700:20::681a:a19
2606:4700:4400::ac40:99f6
2606:4700::6810:7caf
2606:4700::6812:18ad
2606:ae80:1471:16::730
2607:f8b0:4004:c0b::9a
2607:f8b0:4006:809::2001
2607:f8b0:4006:80a::200a
2607:f8b0:4006:80f::2008
2607:f8b0:4006:816::2002
2607:f8b0:4006:816::2004
2607:f8b0:4006:81c::2002
2607:f8b0:4006:81c::200a
2607:f8b0:4006:821::2001
2607:f8b0:4006:824::2002
2607:f8b0:4020:804::2003
2607:f8b0:4020:805::2006
2607:f8b0:4020:805::200d
2607:f8b0:4020:806::2002
2607:f8b0:4020:807::2003
2607:f8b0:4020:807::200a
2607:f8b0:4020:807::200e
2620:100:a001::18
2620:100:a001::4
2620:100:a001::c
2620:112:f002:bbbb::21
2620:112:f002:bbbb::23
2620:116:800b:21:b08a:1dc5:659b:4055
2620:1ec:c11::200
2a02:6ea0:c400::11
2a03:2880:f012:8:face:b00c:0:1
2a03:2880:f112:83:face:b00c:0:25de
2a04:4e42:600::282
2a04:4e42::300
2a04:4e42::485
3.14.222.105
3.214.33.241
3.215.224.52
3.221.8.21
3.223.221.83
3.225.218.10
3.227.148.228
3.227.221.232
3.228.62.117
3.234.11.15
3.234.8.191
3.33.220.150
34.102.163.6
34.102.253.54
34.111.113.62
34.111.151.213
34.117.228.201
34.196.240.226
34.203.16.231
34.204.237.207
34.228.182.143
34.246.81.142
34.95.69.49
34.96.105.8
34.98.67.3
35.169.137.149
35.171.239.119
35.186.193.173
35.190.38.143
35.190.60.146
35.190.90.30
35.207.24.140
35.208.249.213
35.210.53.219
35.211.178.172
35.214.175.237
35.236.220.17
35.244.159.8
35.71.139.29
37.157.6.233
37.157.6.254
40.71.13.169
44.207.246.26
44.209.151.219
50.16.197.56
50.16.251.137
50.16.55.145
50.57.31.206
51.222.39.184
51.255.68.171
52.116.53.150
52.200.130.143
52.204.92.248
52.205.175.196
52.217.193.97
52.217.228.1
52.29.104.196
52.40.223.220
52.45.162.216
52.45.73.233
52.46.128.147
52.55.146.213
52.71.141.42
52.72.252.60
52.85.61.47
52.85.61.61
52.85.61.83
54.144.144.142
54.145.44.246
54.156.165.4
54.162.81.74
54.163.224.69
54.164.26.28
54.205.176.242
54.208.104.226
54.210.26.99
54.84.64.172
63.251.28.234
63.251.86.49
63.251.86.50
64.202.112.191
67.202.105.23
67.220.228.202
68.67.160.26
68.67.161.182
68.67.179.113
69.166.1.12
69.173.151.100
69.90.254.78
70.42.32.63
72.251.229.176
74.119.119.139
74.119.119.150
74.121.140.211
8.2.108.194
8.2.111.13
8.28.7.81
8.28.7.83
80.77.87.161
82.145.213.8
96.17.64.208
96.46.183.20
0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5
00c5ac1bd4e9c9bb41e4d5c5c475c85acc964b1017eb72a152598e91c86854c9
0152a088a37330522c1458229707cbc27e42f802e1ba385d887b8a0069927618
01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392
03d9c6282533912a324c1d6f7c0c06583bed3f2c3a4a2331a6c36df3602faf52
041f41b6b98e101febe7d24b8d7fdd9fd696dabad0fbe296c978272491c2a791
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1
05112ac6bec76b85c530e82120bd2b9b567f7d82e218a13e397076b96210c74c
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
057f393e06cebae396eaa41b3e932ea15b338d640a4b890d49c4810210b3bd26
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
077ef38850eff4b2826b88ee927b76f06a14d993f9494b2a38b70f1bbcf45ee5
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e
0a3641139a73693dfa9338ac65bad55975a611523388e41d821c8b1e1182c64d
0a5d910fd20b5c3d71577cf1ea50251764c9ad247e7bc15fdaa15dc2daafd541
0b3f7c88870faac2e6dad62d6c766326944e9bb06bdcabecf5da85b150f4373a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c2bcf8f2cac8b0d68b5a92d6de41d8abc998664cbbd473af40ecece0674ace3
0e5ee8b14fb0279a76775e20872eab39e19ccbb0754e5692415ba900739155db
0e8e9fab28b24199f9d2b90a2b0996495b9d68cbe71550e5c4780bbf7028296f
0ecf1caa8d2b7b759753f86062910edeb05d5465f35226fa489818107fe805db
0f27b15848fb3a09df5fa1ba8e2ae9a80ca73faca61455767cd28318fd3c2c6b
0fd81fe58c3f48e962de6a92e22e34ab3f89179c651874d87307abeeed9094c8
105b7dfb695fef25edebb431efe72fa3d34ff28af8dfa3ba360528eed4f8688d
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8
107b066b43b8cb84453e8682c17f57bffc22b78e1093993aebee11023e6b1839
112e4437cd11cf2bb4596bd53bf208420b24ee7f5532c92879e23f82c64c77e4
123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23
124f165a1243b48bd2ac21cebd8852c818c5deb7692fbfb5c80f5d5b72625da9
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4
12da6fafe2e21d807d0f688ef6804fd25cbf2ec7234aca6951fd24d141677aec
1313e544d95566c0ed767f40117a8287940c2856fb450d6a4224b8db33a97902
136a576886a9ae3b5d55278a3e69a1fcc0a2189dfbf77ec41787742f260e5526
141edd521ee7dc499dfaaa8b9cebd09a7be6cba128d788b5a5388232eeabc462
147d25e8517bdfabf13dd9398299b6ca9583d218e57ae2e9a1576cb3dc94e65c
14e71be3ff5aa2e7773210530b6f25ac38218c1833c4efec611f8c89e650db52
14f3a2330f6d02bcd5407635a03c7ab8ed1aa494914c05881137c5e86ae20acf
153c4c5dacad490923052c36818d3ecf8f16bc73dd851020aa8b65351eb8004e
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
168c5eaea7608001599828cc6f103ea4a659d4882b95a7cfdec2cd6ccb3330c3
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba
19cf792a649556b6e99d788a69b1e501dc0748c010896e4fd4081eca8ab0983c
1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
1cc1846f9b84179d7a072de956b23ab2732f8d0d1f88ddc193f446febd1913e8
1cfd94e29569cdb86e0af17ba81d1ee4afb420ec526807697af20dc923f1a52e
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903
20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a
21b580c0e786d0ff2b8ef69d2808f19c17e9106f4effdf1771475ac870c81ea1
234ad8ca5417a1cac554e51d21aacf43a8dee208eb8b42740f5fab2ad015047f
24999918b7aa7fd5adeca29162085186c3e7cdee5914709c9a927b46b48f05b9
24fb187859838f077fa43932d17ce42ee922907e12142d8b9e8f33ff819fb2c4
2514bef258fb6cb4e11afb83730adf6738dcb9199b03ec947b093aa8318eb1d0
266185038ddc6adec0aa3b7705ff4f4ee91686273b22ed59fb4b466dc4625dbb
26b5e382ed7fcf2b1ab871c80a6d32b75522223b2001bd9d7a1718af5e6f3050
270fb1f5320e32a7e0b8af9d3102063d8eb8950f4feb0ce3bb6c00536c1daa60
27e29a5aebbbc2d82b6f7d9dbbf03ced7ecaf592adf68338a02aff332b3e7bd5
2943a138fb8248f4ef8d8ac14a988ef46f8bb5d3aa964ff227082c1651e46dbf
2996fd08efe95bc991934e4be7708f059b0c7595e9410c883ae5385e9e174e7c
2a30e8fbc9d0c48c41d2e345100ff5981a1ce634740ba0de1e0ceacd913d604b
2a7db475948607918756e70471860bd44d4c644bc18a22a2ff3ea249173cbb7a
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2aa50c9706f2175ff0a141b65a82f4c0a8907f75779f00d9d29d31a09c58121f
2c95bbac8e167a1fd9297768d9c45d1f50db54733b750ae889b3a5efd2fae8fa
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435
2d807b19c6bf86acf54706af03abe962dbd480058139107998c5ccc7574b0ea2
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e6242b62f1ae154639748873e42455c907d129745c92fb5cb774e77ccc2e626
2f218961fc995f27f5868268ca3f765d4e7066eb6144139ce5b9eefe9b9ad443
2f218987261e49e368f7f85f9e5bf66f49f62032e96bb064c43064df8fc4e2fd
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
30a6d94c4a599137fb0867f1f6b6008950b81978f1982d91c805904b7852c7c4
30dd4d046ee0a560951014c2c3f71fb0b620af27279bd7c5ff8b4ac877214291
31c86114d8c9683bade57e627634f040284e99a601deb292b961108e5d831415
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
350246718a36866e0ea74a03baf6e2560a7d880a7d0d4aff4f460aa2fea74a51
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
37cbd4d5cd54d815abbd679083f0a6665a14eddf560765e8ef872c9125057847
3916390d4395ed16641c0e23d5e5a1bef9de6ce71b02c3941c0ee6f2d899c806
392c32f20b9f867852a946a6ed1c5e21476df9619083548b6585d80a3b5f9bd4
39b076e4bb4fab9b8a142499cf6155f8c128464974691a04de7e764f71b72618
3b382b0d9b44215db119e3a25e77d61eb223330108a79f83ee18207c4c17cd1a
3c49b33a0fcabeab1ad43b32ccaa44f730c0df05614b7001eb55c71abb29fdbd
3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3d7a16ff1ffd8d8507acd6f1ac3f27609a4e979b0a8e37474d3e0ba43e20fe3c
3dcd45666d5b57f86b6ebc07ca730eb83ef434fc8ae9bc1d345cddeb3cfd140c
3e7d49f24d56db02c7baca8ae3a17555c2e527571450e8c24c77b453407e267a
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3f0acd22b0d5382be314a26f1b77ec2b0842c205abe480dc0c8c2d67342a23a1
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
42167231fcba70dca531765a4ded0dadc84655682060d75289c9c753acaa13ae
4424132c76bd3b942b9a4b0dc628dc4cd5826b75022aca28ad4ae6a696f35437
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655
463b965e90a6c1e92161047e09f18a7b0c5bfe39c59de875536a744922f18285
46491fce827ad4aadc653b93c42c9bf516b3e0cc3a231ba9574518f14a993a6d
466ec9b2f0df33cc46e00e0ab19347b6a0d5e0123fdd7809ff2c3d361eedbc0e
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b
4763afcb2ded007415b72bae7f50a7260a35a51985de43111524275c11b8247f
47837a16e7b231cca39151ae124c3cb8ad0fb875a78fb39ef15725f9bd7a8870
48258a418142de5167fc5cf23d6bd09ecf33c56294a3775519c5897195100fca
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4a7cc3810e9012a315f69d1dc6a4089e5b1e8db39f1707d3dd4d22c67462bb51
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c216860f82a201e909b917ff2eca53e9787b05ec1fe5a69a0d4b994d95781c5
4c3266121854510a342e6633c770a9664f08975777607c27612242e4cf5fd059
4c73bc8022226d1a73f2539913ed8a47adff1ccc3432b275e1eab91eff47df7e
4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668
4d04e98fa76e2cdba4b0b45b0b206b13de39ff72f6371b7d97ed515e21646722
4dd014d13c7aa676ae297ebf87b7bf656718fbf3eecd9bb794e9a6743a112524
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
4fa898d9bdc34304905c4b165e561c8dc3fe452b0bdd7259140e1aa530a42136
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
51637839e823bd483e5de497c31073f2f98df12494a930fc904849595bf72ed6
51b9c4f1aa6c3e60906e6dad687a22e11aa9f5e517d748eafcba598b1a683b30
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
562c727492803b977118034f51a63502bd3ebcb6e7b7663ae73a8ca73b3cb1e1
5779472c525d78941bcf719d14188b7104257c91253905e40277e5e0eae6ce06
57d795ebb29306258ea950b57deaec4d21898f886646f32f20b5e3e75d000523
588ca57d95e8baf84218a1155de25c911c9a88308083f27f47c41cbb0b818b16
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4
58e3e66ae0356604d88fc7ffe4b1962b51b333586da8d54c42fa3c1ee53acb41
5ad96953ed9f09eb237595f0947c8a02ebc9b14131cd128fecdfc16bf91297ba
5af7f54e4682da1be1484f658f9b15a84537085a4081cef229704a6d8e4ceb71
5b70d8eb19ca32d244e29e759e816c343be893232978532c9d5943f838e60e0b
5bdd273208626275755db12c0c38e9df2cae6221aa4cea3d467daf54d0cd4db7
5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8
5ce0cb7f558c1aca9c6e94c7d85d76db859218132923c039b7ef7b38a29f8dfd
5d718b0fd040ff84f5e45af823f082efe2dcefc5aa392da7596e41bf3e25beca
5d7c5d22a81ee3d27800eb5d20b5f160efb6cf98d51dd1f0cca7485442f2c5f4
5f5c7cc2b7dbe80e8858146c5ad1bf23f228077e93c109531df8b08c2c03cf62
5f78f98a558d27197934b2f0a131bf9ce129d1cc2af4e7c7dc0dc7f0670fea29
5ffab5e51399131eb22e55cc7405afb4bc4b2422cab0dc142d6383a19dac7642
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
6020e58617f93875554a133f107b287c97dd12c8d8b6c0eb3f46f2d04a722be4
602fa5427a46cf590fddda3739e9bd055ef29862c67170a4cf18199108a6b4ad
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63bf0a6c2c57a373235701ad52d72b013560770465fcd10ca88a8ef5158d8b24
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
63ff9dc8f7ee5076b45256023dd1071bb914f2b52d49749c01f52f150326f77e
6427d1eba7c9030eb9adfa1f78065baaa768d935979384935676d60f1b21374d
64816ef42196992f1120608cafa36df8e03c81064551abb6f23bc00f69bf6727
65e12db1e4a9e1a532fb6ef30bb1bae9c28cd76e68f346e7fe0af8b60253cf7f
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6c591551bbf2ca5f1f6edb27d23644c42abc00a5f041b29d837bb4c1206fe078
6cd3cf5f204d9c728f91590d92ce0fd61491617a06a9bbfd9928a6eed3e9088b
6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a
6e2d2c853e60809ca916eab7239037e6f86827eff837564ca5736a934ae69bbe
6ff6e32d32130de1c69ebdd3aaa16e3cbb97b13329af55c3d66ff98aafd635b7
702257d6c7995dd0b24f4c22da91edd4df59c140ade70332400fb2544820a2b4
70fd869f92915eb3c9f85d2d2b5a473ba45239ae463b35267642335337c46f06
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48
743fab9929b06e6ea08ee7296b84d0068d27d9fe7552b69f351a3298b968910a
752cb6627738044d241aea7470759409cd69b5d7d639d298b065ad601f304ca4
753c16b10b576d7713f33741b0ebaefb88c05cf788a48b8e4f97ecbfec17c157
75e752bf99299219069a5af90f61408be1ab85af71df9aea097bc70e9075c122
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
770e9e490a714f161fcdda1092ce520bbee93b7964543ae8504770f59348bc5a
7794e2c0a45ba98df9b859bf73aad7e17c7ad09e0d04c8aa389e6f072ddfa3e7
77e486a7a408a776660e91616f44c25c88731da84c3167624cca496a6a768e12
781b3e8726a42112cd2192dd9654cf6eaf79525c7780e3c4fd8469125cc99563
7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c
7a5a973bdf6c962f88511085ae9b054e0acfd78103acb907677e8e81dd1f7f87
7a6e593f715545a4262c0d9a90d157b6b18ae0900ca6ddf3c6d568134310fc2f
7b761f4cb092d9d7a330ce8aa8379c1a3e92bf0df7cbd1ebf875e9e45fdef086
7bd8b3e8c5d0f5c0a1c5ed3b69c09e4ae5edb40519ad8a1882b007ac3bf91901
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
7c46d9a954829d09583e3af58d09df0ab2773f37dc1e3ad593d382c2234fed47
7c5c0f775d4e0b4ed66cf5e30e50d6f158bcce6dcae47bbab3d512be51d171ca
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
7e92ab9e4ba75961e7d2bae7f78562a4ce50286563dff26d4fa630a100accec5
7f295fdb1019a3c2ff2479582f5eda1915c67e8d8634f8b089920f86b6cc4fb7
7f5d73c848836745a93ff7aa540a8f83f9899e3668628f42e9ba0cc6ef5e0b32
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
80d5d83d402cf42a5ae0ef1758e705922e67a9dcd4853314f68da63b7194aafb
80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932
811f138b528716e41195f088d8a05969a76e5d03198289c0e9bb866d55ce30dc
8183520fa4397ff540a38d153dfc93511291c9930f9bb099c1d5e205a8e99a9c
820bbf383e1e212ca7bd59f29af6ab490ea9da86e84d61ed3322b9c77ac2fc6c
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
839c424b188a9bdafd46e5b643a2c5afb4b7df5e51f0321ffafd5f23b118e259
83ae7ba0370974e803fb70ffffd92deb797d08198ed6310e207ba7d75b72029e
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
852c97ef5719292c20ce99a105b210a526e92b1df5d7341002548ba7604e19d3
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246
85856a36baf6ffc82ff928f4bcc07cab5097a0dabb7d6dc56fff6d7246db05db
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
89450305fe6b6f102efbe6354e00ef976d0cb49fc27085d21ec03efd2a4cdef6
89970e3517ddce1c58be0161f4b566efe8707401b092de1579aec82b01cd4d68
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8b1ce8f1d98dd6f410e69411b02f8ddb640c362854ca9c0a9a01c4a21791af84
8b8afd8f60833ca51907899d4a3279cdfd355282858ba8a73cd1034d2a1e31ff
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8ef928fdfb8f3eeb4227af511515120e98219ce1326c45212eaecdad5cc8ae7a
8f5b3f7177261796d36de2d220664c09162d3877eb2e3868406c27ac952520a1
8f94c34640d5f28f0157715396f0fcc3583fce5342bc7f44ce8baf3464ddda9e
91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
933ff38629199ba200d23e1a3afda3ca9cae06352169926a4609942ab4d3742b
93e018a7792b5464deeca7b2e56fae7f27d31ae4250c6544744e06afdd4fe64c
93e6639c3f07cb77467754907778fc49a74b1194368a93923c824ebec4d78298
95bba4baf05ca525916be57e936921d45491734debfd9f197030ffbf6835b083
986ccecb5ddec6d653cdb03022cbb35af07301b752cad8ac1d6c7aa66a11e661
9887fc8a93ecf96e2d9e31c13e0183839bdc8dc0344c7b0b3ab42bcb8d2aa0b4
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
98d7545780ac424b4a059f21f71f5efc95a7fb9fc716c882ab6012a18ed397e5
99219826e932380f0b45b7b6a348011dfa189c7d178b2d963a68da9685bf9513
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9c3cca60917c7728244dd474018bdf1c87df8af530770e92b6aef5f5708d7c89
9c5294b56577e7ddc7459384d98960e73d9c6c5cd38e46d4162660d5dcfb23d9
9d16f92ac1ebed546cb20a26bb1de836ed91b8ae6c61d655ddd998dc0a70f766
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
9f3266b12e76f135c13f4faedb2f87832433f7125b9c41d5f73f6182be47a189
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1acc097ac669715d7ddb34d1045b1d34989c0c34a72ce3c97196008ccd1fbab
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4
a1e1f394d80cb863930fcf77bfa7cb31c24012649626faa11d36353f5267ddf6
a328a83475f5479bdb8973a72516200628c68156e62085ffe830de768de194e5
a39def26a2cee84287e689cd445d880ef7dd744ed43974ff75bcc5b376b2e123
a41b806e591339f4357460a85a5c04b8f473f1c80ef3a1c3e3e14cf76f4471d4
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
a4a0fe9f93960096c5eabc3edb9225d43eaec4a308ac0f60dd3db4195dc058da
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4a998cb37a5d4bf74c2dfbb884499166a2d9db6e68b116f642005d37a03c470
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a54690656b18f041c597eb704cbc6ee95c571db2ed7460392e7c49b899dcc74f
a63284d0b07236a49f89dd197f9aa2ea595e314e750b5d42834fbda2f7cba411
a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032
a800be47e589df526eee6a11643f60c0fbdb2f8d76428a4cd727a95be85959c6
a832c721859e66024092445300431d52b19ce96eb53588ad13954e78be2a8580
a8f2fd64aefb16b857bd383e284f8fa54868176b1d006243914d1f95479aa3ad
a9b8757ef83403b67a3f6d10da0c8f4259179fe48a775020aeb65ab9e1791cc3
ab2d643da45088d90baa8f575d61ba7c31e3fc724cf8c1d4d605ebbb0b2a397c
ab381d8582319166d69ba8c745c6ad00999307d4aaed7116d93272764f604604
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543
ac888a811086e5e08352c3dc0d0b704206641c37f78b1932c3ca956367aed497
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
adac5f0ac3cba09025628039e8467b22408fa62d59c8b9c1b5b7f4a412306741
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aee4051a20e975b9bb6fdc20984a091eb1f55c35ea87abe441db4cdbe8c116d0
af791f4ecfb200dd519a03dc1760721fd4fc36cd3ef9f0b5caf592f9a3d49b91
aff8084000d2c0e029860444700f6c44b5d0124101ae9f87a9bb7d6b574fe24e
b02a07342638ea98c3fbf00cd0288dc5f373ae024480bdedbb4e851d47a57ac5
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5
b34b500b4fe4d4f0be72fcb5b7c582c472495b1498072d19a1aaac0dc2022195
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
b3d0a0b4d857b709736ab97f8ae450f34c96e6e6a5422388708177747ea34f13
b3eccc3acdf622eb62b23c8aa6829439e1d3e9e670c757b0539673873e68cbf6
b4ef7da471b1261442e541f8a301ba82df7031093b7092ddbb1677de527444a0
ba5a6577ef04a324ae8a4af890e1e26d341ac85bc5c49ad9be1678a61fcc3168
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bc82310d2b82f3aa74a269e8f679359bda827c649adb41486fd1af268a026ac1
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c38bc51d1b1c8db7f2037ae18da46d0fb6733d3e7bee635e160eb73f870d5a6e
c3f5a365e519b032ccd4f69f5a5dade3077b83200efb5313936d71058d7df18d
c48759fde37b3ae4312d1726735c09ffb39965c5e39beb88cef202ff9e5ed28a
c540cdeba4eb897beea1c93c6452269a4de7b86a2e670b5b0ad37f9bbfc78c53
c573dbd224f1dac44a6e38a48cf3c955c54429a419f792838ae57f6f318184bc
c5993f8467dfbb45dfd3f751abd48089b840da8105caca380d0bc0f8ec387b11
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
c6038de77c2fca2f75327c1e7ec4751a8d45cc3737395a2abe403ac6d8e98144
c9940eea00a0c63e08ca41c46f1daecad74017966c12b61932472375efd064e6
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cbccc935557398179deeef044a5ab2353e97ca4961f313793c8ba03964c43e93
cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7
cce63ff3511f00d546e736ef2d31a8366ec9dfbfff2eaaf91c1ca0d214024ca2
cd0b7385c8a691d9b2e7af11f3fbe1e7b1f42ecf11531882594908bf4a1b830e
cdd102d71e33401eb5ebadb19f1732edafa44df8800da6d33f29329c3ed9baef
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c
ce37aa7f0bba919bfd53c5c9bf7628c73a5bf07d80bc14abc8c242753a655ab8
cf20568a837b9f3871e57d70a7324da60b458aa58e5b9b74289dc319c3a90dcb
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0384208724718f4ce8f1e4c5a90a4261d7ec5c2e0197bdef1fc4c3281ac2d2d
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d050ff373959aca7a28e6b8af392e1ef9097c5c3b78d1fc544c9fdc827fa20b3
d19ef88f5f15554d56524ecb3374654b73335e910648b501d45c845d668d8f28
d243481a66bdffbe09bc2f74f8f1b57714dcd20963e8703c1372716d3fe689a5
d2994bd7f1adf7962df276de646190f2bd9d625c47ddec7711eed7ea82fb8273
d2cf823ebd1e2d7b0649b99673b599eda7de0e6f83e2ef0d09531576709b0ec8
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
d4743d01a4bb11d4b59fea90ab1973a8706d8c99ae2bdf5092540a6986bf2da0
d4aa3797d0820727bb2e73755dcddb64640c70aee9a08d9e0fbd3ce002c2e87d
d563298c3ede28f01a71384931c619cda9aadce1007034f284f3c0f0316303f0
d623d4148afe3958f8cf929fccf8a2661b93a30e7f0550fd26f478dca78ab492
d626c98d96c73f2397b9e3113d1ef093f05250483897d4125d3fe421ce4da8e2
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
d8b0939d4ad62069a09916859d301d5a0d9c00e9174ad682c53bc122a35bf80e
d975ebce186e1c0c67b2c148153140b918f8d505b8d0034c0832c20cb79308fe
d99139d14823693f61e51a58956ed62e81bb5cd72abb48118a131bacd1f5055e
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
da4be96a7f889837492287bae2ce3b85ff70c2ba8274bf0ee3c9c8b36f63aa97
db1be639c6bb1d11edb8c716a629847c3e0f5492de69797d3619b34ddd34e878
dc0da2082ec514b4250ffe29a176826c3aef94d4ca0f887586528add66a99f16
dc262521a295b46a17eeb5d65d95bb8850fe237802a944c204c893b092e9ab76
dd76966336047650cefcf04deb9fa6109be2943b6c5c5fae4ee733238ad6f281
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
ddc148b8a0a27b1449fda6033f4a0defac9bd43210117b50d5d7ad1eda09f394
ddfc7023909c96c0e99dbe50a4996729935a473233c33c555b8fbf3ab2ee3c84
df0ef2e0d44b640bbb8329f32a6d04508050e23933a59c9e5c59f76c2da85bd8
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b9d318b3157ccbfc3bb00e82a446613294f9a592c01537662386bd848882b7
e3d7ed7dd0b1b54509a0d0986c8ac346015db967344155f901a2dfb63c0dfb6a
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e
e5477888a979c7b864fafa6a3de860371886602af3e9d0be3f838e7c10dd5500
e561b7eb91282aba0090eb6b74465305f2dbfd9c5ff885d344ec2721fe6f978f
e6274310a5c0cfa834924a04b64dd415590f93c26e64ada9708371f7fac18394
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216
e87e5b0d6887c7e21b48b3750342d785840fc5c462244144bed61526bb8457a8
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
e9093e9b56981654429a5fb67048b3a2b1fbd3d5307a08f5c080d646d682b8fb
e99d6f426cab27b57376e9e3da4b0661152e865bfb401185de9296d90f56cfd1
ea25658103c080ba576e704ef1f3d174a8cb48b9dba8d447f110778fcc5ead0b
eabc0f4a5b76ceb76d11713e56e77dc230f3672c9df4c43a79089fa69b056033
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
ebe57ea45a2226e928d739f6bdd9bb1d0425134d06a8d88cc0c669cfcb3123e2
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a
ee004e19a65d9657ccfd05c3c15ed2a49fafecb011b8dc60c799da2fc606fdcf
ef13b0253a986d36b9de961b9d657b6735fc409299b451d1e9a1454f66ce2fec
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f05d3a37fe8746b17c50681d854a40f43fffb5d5ef7d72d8a494e7498daeda23
f17d4e620e0a5588a48090a12efea067a96984b306d7bafa21de9cc18fcf8dc7
f26f1bddadc6983f931a2de6e6365b4dc312b3df8cec9b011e88ed1b026a72ce
f3988a8a95c5faec9bb5307667596b220a12d277072950244393b5f33091e2fb
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f42437392991256301d04a743ae9c380aae62faef9a5bb0d4dde967ae9681df9
f4fd43c5cac123f7e4194c8d3fea22fbe20ccc723cf6ca38362cc0297c27c08e
f63b683b181032b37e4b8a3fe5d001edc0b40a8df47c66b7966e2e7242f0226d
f67c1dae64731f037f0dcd7598af600024c9546bbdeed1c9f7185b027ef65bb4
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f696848774a0c784c368e7c24c5902acfeee7f611d04b6ac48c17991ebbe4d0b
f6d8894bccb6968f9c55a23894a63a454f3425a7a4c19251ba01d9e3493084a0
f777c35c89d1682e92541bdb23748223b52de0e588908a991a43df2129fdc62e
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f8e60fa507399273a3862f6ca5b4daf3df1b225801d641c564a10336e84773e5
f8f6e6804f596da6c539bcc54ede0b71b40afbd35e88d00c3a64d5b61218e0de
f9a269cb808e24336f19430d384c3cc05b4817c3d637eefb294db4072a7fccd8
f9c4ffcfab2c93ba07bd2d4a2dd53a1d23faace457ade18c52c3f4ea67b8ea68
f9d24c71e954513157a412b5339112437e013cf99070b258e445101f16747500
f9e7478a7ceb5f02339cda0af1f0df3c8f3d108b1f9d5323b962017919ae555f
feb0e7f17014201ea9124f23e3f63965411385abf0103fc682595d0674087a0c
ffbd2ddea8b43e195d7746233abc36e820a81bf3077f1a34fbc3cd214c4339bc