urlscan.io logo urlscan.io
SecurityTrails logo

www.mercurynews.com Open in urlscan Pro
192.0.66.2  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tell...
Effective URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tell...
Submission: On June 20 via api from US — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 177 IPs in 12 countries across 173 domains to perform 999 HTTP transactions. The main IP is 192.0.66.2, located in San Francisco, United States and belongs to AUTOMATTIC, US. The main domain is www.mercurynews.com. The Cisco Umbrella rank of the primary domain is 65849.
TLS certificate: Issued by R3 on May 21st 2023. Valid for: 3 months.
This is the only time www.mercurynews.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 28 192.0.66.2 2635 (AUTOMATTIC)
2 13.33.60.51 16509 (AMAZON-02)
3 2a04:4e42::485 54113 (FASTLY)
4 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
1 2600:9000:251... 16509 (AMAZON-02)
3 2607:f8b0:400... 15169 (GOOGLE)
1 143.204.146.67 16509 (AMAZON-02)
16 18.164.96.64 16509 (AMAZON-02)
3 2600:9000:251... 16509 (AMAZON-02)
1 20.60.62.4 8075 (MICROSOFT...)
2 13.225.214.63 16509 (AMAZON-02)
1 18.164.101.60 16509 (AMAZON-02)
1 2600:9000:21d... 16509 (AMAZON-02)
21 2607:f8b0:400... 15169 (GOOGLE)
2 192.0.76.3 2635 (AUTOMATTIC)
2 2606:2800:11f... 15133 (EDGECAST)
1 2a04:4e42::282 54113 (FASTLY)
4 52.40.223.220 16509 (AMAZON-02)
3 34.237.129.106 14618 (AMAZON-AES)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
61 151.101.1.44 54113 (FASTLY)
5 2607:f8b0:400... 15169 (GOOGLE)
9 2607:f8b0:400... 15169 (GOOGLE)
1 52.205.167.202 14618 (AMAZON-AES)
4 35.190.38.143 15169 (GOOGLE)
3 108.138.107.138 16509 (AMAZON-02)
8 2606:2800:11f... 15133 (EDGECAST)
1 2600:1f18:44f... 14618 (AMAZON-AES)
3 192.0.77.48 2635 (AUTOMATTIC)
5 7 2620:116:800b... 14618 (AMAZON-AES)
2 4 207.198.113.230 13768 (COGECO-PEER1)
2 2606:4700:440... 13335 (CLOUDFLAR...)
1 13.35.93.44 16509 (AMAZON-02)
2 6 13.35.93.41 16509 (AMAZON-02)
2 137.184.240.117 14061 (DIGITALOC...)
1 52.2.47.221 14618 (AMAZON-AES)
8 18 2620:100:a001::c 19750 (AS-CRITEO)
4 2602:803:c002... 26667 (RUBICONPR...)
1 54.172.46.145 14618 (AMAZON-AES)
1 6 3.218.133.69 14618 (AMAZON-AES)
9 2620:100:a001... 19750 (AS-CRITEO)
6 30 68.67.160.117 29990 (ASN-APPNEX)
9 104.36.115.111 62713 (AS-PUBMATIC)
1 104.18.25.185 13335 (CLOUDFLAR...)
1 108.138.126.121 16509 (AMAZON-02)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 2600:9000:251... 16509 (AMAZON-02)
10 2620:100:a001::4 19750 (AS-CRITEO)
1 2600:9000:21d... 16509 (AMAZON-02)
12 2607:f8b0:400... 15169 (GOOGLE)
1 104.117.46.235 16625 (AKAMAI-AS)
1 2 107.178.250.234 396982 (GOOGLE-CL...)
3 5 34.228.89.16 14618 (AMAZON-AES)
4 8 34.111.113.62 396982 (GOOGLE-CL...)
2 2 34.229.3.43 14618 (AMAZON-AES)
1 2a02:6ea0:c40... 60068 (CDN77 ^_^)
1 23.200.197.46 16625 (AKAMAI-AS)
1 4 52.72.123.193 14618 (AMAZON-AES)
2 18.164.116.7 16509 (AMAZON-02)
1 23.54.69.53 16625 (AKAMAI-AS)
2 2600:9000:23c... 16509 (AMAZON-02)
1 2600:9000:220... 16509 (AMAZON-02)
17 18 162.19.138.119 16276 (OVH)
1 3.13.23.188 16509 (AMAZON-02)
4 2a03:2880:f01... 32934 (FACEBOOK)
5 54.162.81.74 14618 (AMAZON-AES)
2 23 52.46.130.91 16509 (AMAZON-02)
1 18.164.116.69 16509 (AMAZON-02)
1 104.26.4.15 13335 (CLOUDFLAR...)
1 52.216.108.235 16509 (AMAZON-02)
1 3.5.28.156 14618 (AMAZON-AES)
3 20 141.226.224.48 200478 (TABOOLA-AS)
1 3.225.113.174 14618 (AMAZON-AES)
1 1 2600:1f18:730... 14618 (AMAZON-AES)
1 52.1.91.70 14618 (AMAZON-AES)
5 3.210.36.192 14618 (AMAZON-AES)
4 2620:1ec:c11:... 8068 (MICROSOFT...)
30 2607:f8b0:400... 15169 (GOOGLE)
11 2607:f8b0:400... 15169 (GOOGLE)
1 1 23.196.180.24 16625 (AKAMAI-AS)
1 1 2600:9000:220... 16509 (AMAZON-02)
7 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
2 52.85.61.61 16509 (AMAZON-02)
1 2 3.213.218.94 14618 (AMAZON-AES)
4 21 192.40.39.223 27381 (CASALE-MEDIA)
2 3 23.105.12.143 30633 (LEASEWEB-...)
8 8 2606:ae80:145... 25751 (VALUECLICK)
12 18 18.215.8.84 14618 (AMAZON-AES)
10 23.54.68.197 16625 (AKAMAI-AS)
2 52.203.194.180 14618 (AMAZON-AES)
2 20 104.127.172.242 16625 (AKAMAI-AS)
5 9 198.148.27.139 19189 (PULSEPOINT)
2 44.206.150.230 14618 (AMAZON-AES)
5 5 23.92.190.74 10913 (INTERNAP-BLK)
1 7 23.92.190.69 32475 (SINGLEHOP...)
11 3.227.148.228 14618 (AMAZON-AES)
3 6 35.71.139.29 16509 (AMAZON-02)
1 23.58.157.143 20940 (AKAMAI-ASN1)
2 23.54.69.151 16625 (AKAMAI-AS)
3 6 68.67.179.89 29990 (ASN-APPNEX)
14 2607:f8b0:400... 15169 (GOOGLE)
1 104.117.182.40 20940 (AKAMAI-ASN1)
9 34.196.107.2 14618 (AMAZON-AES)
1 19 3.213.224.199 14618 (AMAZON-AES)
25 25 35.211.178.172 19527 (GOOGLE-2)
2 3 34.230.233.1 14618 (AMAZON-AES)
5 5 52.20.224.27 14618 (AMAZON-AES)
6 6 64.202.112.223 23352 (SERVERCEN...)
5 6 104.76.100.229 16625 (AKAMAI-AS)
3 3 70.42.32.191 22075 (AS-OUTBRAIN)
5 11 34.98.64.218 396982 (GOOGLE-CL...)
3 6 2600:1f18:4e9... 14618 (AMAZON-AES)
2 2 52.0.201.47 14618 (AMAZON-AES)
2 2 2603:c020:400... 31898 (ORACLE-BM...)
1 2 169.197.150.8 398989 (DEEPINTENT)
2 2 52.73.23.114 14618 (AMAZON-AES)
21 28 142.250.80.34 15169 (GOOGLE)
22 23 35.71.131.137 16509 (AMAZON-02)
3 3 173.231.178.116 32475 (SINGLEHOP...)
3 3 34.171.234.26 396982 (GOOGLE-CL...)
2 2600:1f18:61c... 14618 (AMAZON-AES)
8 74.119.119.139 19750 (AS-CRITEO)
6 6 63.251.28.233 26558 (FREEWHEEL)
1 23.52.163.93 16625 (AKAMAI-AS)
1 1 69.166.1.10 27630 (AS-XFERNET)
4 4 35.214.152.43 15169 (GOOGLE)
3 3 34.200.65.202 14618 (AMAZON-AES)
12 14 8.28.7.82 62713 (AS-PUBMATIC)
11 34 8.28.7.83 62713 (AS-PUBMATIC)
1 1 67.202.105.21 32748 (STEADFAST)
9 12 8.43.72.98 26667 (RUBICONPR...)
29 31 199.127.204.171 26120 (RHYTHMONE)
3 3 2620:112:f002... 6336 (TURN-US-ASN)
1 174.137.133.32 27257 (WEBAIR-IN...)
1 8.2.111.13 46636 (NATCOWEB)
7 8 74.121.140.211 30419 (MEDIAMATH...)
5 6 151.101.66.49 54113 (FASTLY)
3 3 35.207.24.140 15169 (GOOGLE)
1 34.96.105.8 396982 (GOOGLE-CL...)
1 1 213.19.162.90 3356 (LEVEL3)
1 51.222.39.187 16276 (OVH)
2 2 202.241.208.56 4694 (IDCF IDC ...)
1 80.77.87.161 46636 (NATCOWEB)
8 8 185.184.8.90 204995 (RTB-HOUSE...)
1 2607:f8b0:400... 15169 (GOOGLE)
4 7 54.92.222.20 14618 (AMAZON-AES)
2 2 18.198.251.95 16509 (AMAZON-02)
1 1 35.208.249.213 19527 (GOOGLE-2)
1 2 162.248.18.34 62713 (AS-PUBMATIC)
6 30 23.105.14.106 30633 (LEASEWEB-...)
4 4 74.119.119.150 19750 (AS-CRITEO)
4 8 8.28.7.81 62713 (AS-PUBMATIC)
2 2 50.57.31.206 19994 (RACKSPACE)
1 1 204.62.13.72 46636 (NATCOWEB)
1 82.145.213.8 39832 (NO-OPERA)
1 1 2620:112:f002... 6336 (TURN-US-ASN)
2 2600:1f18:ed:... 14618 (AMAZON-AES)
2 2 108.138.106.17 16509 (AMAZON-02)
2 2 199.38.167.131 54312 (ROCKETFUEL)
3 5 35.190.60.146 15169 (GOOGLE)
5 5 185.167.164.39 198622 (ADFORM)
9 52.85.61.67 16509 (AMAZON-02)
12 151.101.65.108 54113 (FASTLY)
7 23.54.68.184 16625 (AKAMAI-AS)
22 68.67.160.75 29990 (ASN-APPNEX)
1 2 34.196.255.49 14618 (AMAZON-AES)
4 4 8.43.72.97 26667 (RUBICONPR...)
1 2620:1ec:21::14 8068 (MICROSOFT...)
1 67.220.228.202 16509 (AMAZON-02)
1 2a04:4e42:400... 54113 (FASTLY)
1 141.226.224.32 200478 (TABOOLA-AS)
8 2606:4700:20:... 13335 (CLOUDFLAR...)
5 34.206.101.164 14618 (AMAZON-AES)
8 37.157.6.233 198622 (ADFORM)
3 79 172.67.10.198 13335 (CLOUDFLAR...)
8 216.22.16.1 30633 (LEASEWEB-...)
2 54.84.64.172 14618 (AMAZON-AES)
3 8.28.7.84 62713 (AS-PUBMATIC)
1 52.85.61.107 16509 (AMAZON-02)
2 2 35.171.239.119 14618 (AMAZON-AES)
2 3.234.237.251 14618 (AMAZON-AES)
2 20.42.73.140 8075 (MICROSOFT...)
7 2a03:2880:f11... 32934 (FACEBOOK)
4 142.250.64.70 15169 (GOOGLE)
16 2607:f8b0:400... 15169 (GOOGLE)
8 142.250.176.194 15169 (GOOGLE)
6 2600:1400:900... 20940 (AKAMAI-ASN1)
4 2607:f8b0:400... 15169 (GOOGLE)
11 11 52.5.243.49 14618 (AMAZON-AES)
2 2 207.198.113.90 13768 (COGECO-PEER1)
1 52.70.0.189 14618 (AMAZON-AES)
1 54.229.88.75 16509 (AMAZON-02)
1 2 38.98.69.175 174 (COGENT-174)
2 2 2604:9e00:1:1... 27257 (WEBAIR-IN...)
1 1 174.137.133.49 27257 (WEBAIR-IN...)
6 34.117.228.201 396982 (GOOGLE-CL...)
2 4 107.178.244.119 15169 (GOOGLE)
2 108.138.106.32 16509 (AMAZON-02)
4 13.85.16.224 8075 (MICROSOFT...)
1 151.101.129.108 54113 (FASTLY)
12 108.139.29.51 16509 (AMAZON-02)
2 34.95.69.49 396982 (GOOGLE-CL...)
1 1 195.244.31.10 63140 (IGUANA-WO...)
2 52.116.53.150 36351 (SOFTLAYER)
2 2 54.205.17.152 14618 (AMAZON-AES)
1 1 69.90.254.78 13768 (COGECO-PEER1)
1 1 34.102.163.6 396982 (GOOGLE-CL...)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 172.104.105.5 63949 (AKAMAI-LI...)
1 35.186.193.173 15169 (GOOGLE)
1 1 20.85.134.6 8075 (MICROSOFT...)
1 162.55.120.196 24940 (HETZNER-AS)
1 195.5.165.20 44968 (IPROM-AS)
2 2 184.27.80.19 16625 (AKAMAI-AS)
2 2 107.178.254.65 396982 (GOOGLE-CL...)
1 1 34.98.67.3 396982 (GOOGLE-CL...)
1 34.203.16.231 14618 (AMAZON-AES)
1 1 34.102.253.54 396982 (GOOGLE-CL...)
1 1 64.227.64.62 14061 (DIGITALOC...)
5 5 54.36.150.180 16276 (OVH)
13 18 138.201.8.249 24940 (HETZNER-AS)
8 8 96.46.186.57 7979 (SERVERS-COM)
12 12 8.2.108.175 46636 (NATCOWEB)
7 7 37.157.6.243 198622 (ADFORM)
2 2600:1f18:1c9... 14618 (AMAZON-AES)
2 2 35.211.233.246 15169 (GOOGLE)
2 2 54.161.170.61 14618 (AMAZON-AES)
3 3 23.105.12.172 30633 (LEASEWEB-...)
2 2 3.227.188.131 14618 (AMAZON-AES)
1 1 85.114.159.93 24961 (MYLOC-AS ...)
1 2 54.84.229.185 14618 (AMAZON-AES)
3 4 52.44.244.58 14618 (AMAZON-AES)
9 2606:4700:10:... 13335 (CLOUDFLAR...)
1 1 34.96.71.22 396982 (GOOGLE-CL...)
999 177
28    192.0.66.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
www.mercurynews.com
2    13.33.60.51 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-60-51.ewr52.r.cloudfront.net
htlbid.com
3    2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
4    2607:f8b0:4006:81c::200a (Flushing, United States)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2607:f8b0:4006:81e::200a (Flushing, United States)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
4    2607:f8b0:4006:80a::200a (Flushing, United States)

ASN15169 (GOOGLE, US)
maps.googleapis.com
1    2600:9000:2511:1000:10:474e:104a:2961 (United States)

ASN16509 (AMAZON-02, US)
cdn.auth0.com
3    2607:f8b0:4006:81d::200d (Flushing, United States)

ASN15169 (GOOGLE, US)
accounts.google.com
1    143.204.146.67 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-146-67.ewr52.r.cloudfront.net
cdn.p-n.io
16    18.164.96.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-96-64.jfk50.r.cloudfront.net
a869.mercurynews.com
3    2600:9000:2510:aa00:3:b7e:8940:93a1 (United States)

ASN16509 (AMAZON-02, US)
cmp.osano.com
1    20.60.62.4 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
prodmg2.blob.core.windows.net
2    13.225.214.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-63.ewr50.r.cloudfront.net
tags.remixd.com
1    18.164.101.60 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-101-60.jfk50.r.cloudfront.net
cdn.parsely.com
1    2600:9000:21dd:d200:8:2ae1:d740:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.viafoura.net
21    2607:f8b0:4006:824::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
2    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
2    2606:2800:11f:17a5:191a:18d5:537:22f9 (United States)

ASN15133 (EDGECAST, US)
az416426.vo.msecnd.net
1    2a04:4e42::282 (United States)

ASN54113 (FASTLY, US)
polyfill.io
4    52.40.223.220 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-40-223-220.us-west-2.compute.amazonaws.com
session.mercurynews.com
3    34.237.129.106 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-237-129-106.compute-1.amazonaws.com
digitalfirstmedia.blueconic.net
2    2606:4700::6810:7eaf (United States)

ASN13335 (CLOUDFLARENET, US)
unpkg.com
61    151.101.1.44 (United States)

ASN54113 (FASTLY, US)
cdn.taboola.com
pm-widget.taboola.com
trc.taboola.com
vidstat.taboola.com
images.taboola.com
imprnjmp.taboola.com
match.taboola.com
5    2607:f8b0:4006:820::2008 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
9    2607:f8b0:4006:820::2003 (Flushing, United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    52.205.167.202 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-167-202.compute-1.amazonaws.com
p1.parsely.com
4    35.190.38.143 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 143.38.190.35.bc.googleusercontent.com
pubcast-files.remixd.com
player-files.remixd.com
3    108.138.107.138 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-107-138.jfk50.r.cloudfront.net
c.amazon-adsystem.com
8    2606:2800:11f:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)
loader-cdn.azureedge.net
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
cdn.czx5eyk0exbhwp43ya.biz
cdn.pranmcpkx.com
1    2600:1f18:44f0:4847:757a:9f73:587:7107 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
api.viafoura.co
3    192.0.77.48 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: s.w.org
s.w.org
7    2620:116:800b:21:4cb8:1820:80ca:50f7 (United States)

ASN14618 (AMAZON-AES, US)
secure.quantserve.com
pixel.quantserve.com
cms.quantserve.com
4    207.198.113.230 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel.sitescout.com
2    2606:4700:4400::6812:220a (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.confiant-integrations.net
1    13.35.93.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-44.jfk50.r.cloudfront.net
launchpad-wrapper.privacymanager.io
6    13.35.93.41 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-41.jfk50.r.cloudfront.net
sb.scorecardresearch.com
2    137.184.240.117 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
www.foo.software
1    52.2.47.221 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-47-221.compute-1.amazonaws.com
i.viafoura.co
18    2620:100:a001::c (United States)

ASN19750 (AS-CRITEO, US)
gum.criteo.com
4    2602:803:c002:200::42 (United States)

ASN26667 (RUBICONPROJECT, US)
fastlane.rubiconproject.com
1    54.172.46.145 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-172-46-145.compute-1.amazonaws.com
tlx.3lift.com
6    3.218.133.69 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-218-133-69.compute-1.amazonaws.com
ads.yieldmo.com
9    2620:100:a001::18 (United States)

ASN19750 (AS-CRITEO, US)
bidder.criteo.com
30    68.67.160.117 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
9    104.36.115.111 (United States)

ASN62713 (AS-PUBMATIC, US)
hbopenbid.pubmatic.com
1    104.18.25.185 (None, )

ASN13335 (CLOUDFLARENET, US)
htlb.casalemedia.com
1    108.138.126.121 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-126-121.jfk50.r.cloudfront.net
aax.amazon-adsystem.com
1    2606:4700:10::6816:3556 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.id5-sync.com
1    2600:9000:2511:a00:a:e047:753:be1 (United States)

ASN16509 (AMAZON-02, US)
cdn.prod.uidapi.com
10    2620:100:a001::4 (United States)

ASN19750 (AS-CRITEO, US)
static.criteo.net
1    2600:9000:21dd:5800:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
rules.quantcount.com
12    2607:f8b0:4006:823::200e (Flushing, United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    104.117.46.235 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-117-46-235.deploy.static.akamaitechnologies.com
s.btstatic.com
2    107.178.250.234 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 234.250.178.107.bc.googleusercontent.com
js.matheranalytics.com
5    34.228.89.16 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-228-89-16.compute-1.amazonaws.com
dpm.demdex.net
8    34.111.113.62 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com
pixel.tapad.com
2    34.229.3.43 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-229-3-43.compute-1.amazonaws.com
loadm.exelator.com
1    2a02:6ea0:c400::12 (New York, United States)

ASN60068 (CDN77 ^_^, GB)
load77.exelator.com
1    23.200.197.46 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-200-197-46.deploy.static.akamaitechnologies.com
sync.teads.tv
4    52.72.123.193 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-123-193.compute-1.amazonaws.com
sync.crwdcntrl.net
bcp.crwdcntrl.net
2    18.164.116.7 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-116-7.jfk50.r.cloudfront.net
consent.api.osano.com
1    23.54.69.53 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-54-69-53.deploy.static.akamaitechnologies.com
s.ntv.io
2    2600:9000:23cb:7c00:8:8845:1500:93a1 (United States)

ASN16509 (AMAZON-02, US)
b-code.liadm.com
1    2600:9000:2209:d200:1:a3fa:7cc0:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.jwplayer.com
18    162.19.138.119 (France)

ASN16276 (OVH, FR)
PTR: ns31533570.ip-162-19-138.eu
id5-sync.com
1    3.13.23.188 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-13-23-188.us-east-2.compute.amazonaws.com
s.thebrighttag.com
4    2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
connect.facebook.net
5    54.162.81.74 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-162-81-74.compute-1.amazonaws.com
www.i.matheranalytics.com
23    52.46.130.91 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
s.amazon-adsystem.com
1    18.164.116.69 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-116-69.jfk50.r.cloudfront.net
launchpad.privacymanager.io
1    104.26.4.15 (None, )

ASN13335 (CLOUDFLARENET, US)
api-mg2.db-ip.com
1    52.216.108.235 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com
paywall-ad-bucket.s3.amazonaws.com
1    3.5.28.156 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: s3-1-w.amazonaws.com
ams-pageview-public.s3.amazonaws.com
20    141.226.224.48 (United States)

ASN200478 (TABOOLA-AS, IL)
us-trc-events.taboola.com
us-match.taboola.com
us-vid-events.taboola.com
sync.taboola.com
sync-t1.taboola.com
1    3.225.113.174 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-113-174.compute-1.amazonaws.com
track.elissa.myastrology.com
1    2600:1f18:730:b130:6259:cdb:fde4:77dc (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
rp.liadm.com
1    52.1.91.70 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-1-91-70.compute-1.amazonaws.com
rp4.liadm.com
5    3.210.36.192 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-210-36-192.compute-1.amazonaws.com
jadserve.postrelease.com
4    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
30    2607:f8b0:4006:822::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
adservice.google.com
pagead2.googlesyndication.com
11    2607:f8b0:4006:821::2001 (Flushing, United States)

ASN15169 (GOOGLE, US)
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com
85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
1    23.196.180.24 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-196-180-24.deploy.static.akamaitechnologies.com
cs.media.net
1    2600:9000:2209:4a00:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)
s.ad.smaato.net
7    2607:f8b0:4006:81c::2004 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.google.com
4    2607:f8b0:4006:822::2003 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.google.ca
2    52.85.61.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-61.ewr53.r.cloudfront.net
geo.privacymanager.io
2    3.213.218.94 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-218-94.compute-1.amazonaws.com
rtb.gumgum.com
21    192.40.39.223 (Canada)

ASN27381 (CASALE-MEDIA, CA)
ssum-sec.casalemedia.com
dsum-sec.casalemedia.com
ssum.casalemedia.com
dsum.casalemedia.com
3    23.105.12.143 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
8    2606:ae80:1451:17::1400 (United States)

ASN25751 (VALUECLICK, US)
amazon-tam-match.dotomi.com
pulsepoint-match.dotomi.com
pubmatic-match.dotomi.com
casale-match.dotomi.com
18    18.215.8.84 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-215-8-84.compute-1.amazonaws.com
match.sharethrough.com
10    23.54.68.197 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-54-68-197.deploy.static.akamaitechnologies.com
ads.pubmatic.com
2    52.203.194.180 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-194-180.compute-1.amazonaws.com
sync-amz.ads.yieldmo.com
sync-pm.ads.yieldmo.com
20    104.127.172.242 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-127-172-242.deploy.static.akamaitechnologies.com
eus.rubiconproject.com
secure-assets.rubiconproject.com
9    198.148.27.139 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
2    44.206.150.230 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-206-150-230.compute-1.amazonaws.com
crb.kargo.com
5    23.92.190.74 (Houston, United States)

ASN10913 (INTERNAP-BLK, US)
ap.lijit.com
7    23.92.190.69 (Houston, United States)

ASN32475 (SINGLEHOP-LLC, US)
ce.lijit.com
11    3.227.148.228 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-148-228.compute-1.amazonaws.com
cs-server-s2s.yellowblue.io
cs.yellowblue.io
6    35.71.139.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: afb83dd09526a6517.awsglobalaccelerator.com
eb2.3lift.com
1    23.58.157.143 (Piscataway, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-58-157-143.deploy.static.akamaitechnologies.com
sli.mercurynews.com
2    23.54.69.151 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-54-69-151.deploy.static.akamaitechnologies.com
z.moatads.com
s-jsonp.moatads.com
6    68.67.179.89 (North Bergen, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
secure.adnxs.com
14    2607:f8b0:4006:823::2002 (Flushing, United States)

ASN15169 (GOOGLE, US)
www.googletagservices.com
1    104.117.182.40 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-117-182-40.deploy.static.akamaitechnologies.com
js.moatads.com
9    34.196.107.2 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-107-2.compute-1.amazonaws.com
protected-by.clarium.io
19    3.213.224.199 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-224-199.compute-1.amazonaws.com
usersync.gumgum.com
25    35.211.178.172 (North Charleston, United States)

ASN19527 (GOOGLE-2, US)
PTR: 172.178.211.35.bc.googleusercontent.com
x.bidswitch.net
3    34.230.233.1 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-230-233-1.compute-1.amazonaws.com
beacon.lynx.cognitivlabs.com
5    52.20.224.27 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-224-27.compute-1.amazonaws.com
sync.srv.stackadapt.com
6    64.202.112.223 (Chicago, United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com
b1sync.zemanta.com
6    104.76.100.229 (Secaucus, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-76-100-229.deploy.static.akamaitechnologies.com
stags.bluekai.com
x.dlx.addthis.com
tags.bluekai.com
3    70.42.32.191 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com
sync.outbrain.com
11    34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com
us-u.openx.net
u.openx.net
eu-u.openx.net
6    2600:1f18:4e9:5a01:1182:3903:eb81:31e2 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
pr-bh.ybp.yahoo.com
2    52.0.201.47 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-201-47.compute-1.amazonaws.com
sync.ipredictive.com
2    2603:c020:400d:3000:bf17:cd18:9a23:846c (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
sync.technoratimedia.com
2    169.197.150.8 (United States)

ASN398989 (DEEPINTENT, US)
PTR: g.deepintent.com
match.deepintent.com
2    52.73.23.114 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-73-23-114.compute-1.amazonaws.com
ad.360yield.com
28    142.250.80.34 (Staten Island, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f2.1e100.net
cm.g.doubleclick.net
23    35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
insight.adsrvr.org
3    173.231.178.116 (Secaucus, United States)

ASN32475 (SINGLEHOP-LLC, US)
PTR: lga-delivery-8.sys.adgear.com
cm.adgrx.com
3    34.171.234.26 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 26.234.171.34.bc.googleusercontent.com
um.simpli.fi
2    2600:1f18:61c0:2204:b513:b8fc:2d8f:8df9 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
d.adroll.com
8    74.119.119.139 (United States)

ASN19750 (AS-CRITEO, US)
mug.criteo.com
6    63.251.28.233 (United States)

ASN26558 (FREEWHEEL, US)
ads.stickyadstv.com
1    23.52.163.93 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-163-93.deploy.static.akamaitechnologies.com
contextual.media.net
1    69.166.1.10 (United States)

ASN27630 (AS-XFERNET, US)
sync.go.sonobi.com
4    35.214.152.43 (Groningen, Netherlands)

ASN15169 (GOOGLE, US)
PTR: 43.152.214.35.bc.googleusercontent.com
csync.loopme.me
3    34.200.65.202 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-200-65-202.compute-1.amazonaws.com
ups.analytics.yahoo.com
14    8.28.7.82 (United States)

ASN62713 (AS-PUBMATIC, US)
image8.pubmatic.com
34    8.28.7.83 (United States)

ASN62713 (AS-PUBMATIC, US)
image2.pubmatic.com
simage2.pubmatic.com
1    67.202.105.21 (Palos Park, United States)

ASN32748 (STEADFAST, US)
PTR: ip21.67-202-105.static.steadfastdns.net
ssc-cms.33across.com
12    8.43.72.98 (United States)

ASN26667 (RUBICONPROJECT, US)
pixel-us-east.rubiconproject.com
pixel.rubiconproject.com
31    199.127.204.171 (United States)

ASN26120 (RHYTHMONE, US)
sync.1rx.io
sync.targeting.unrulymedia.com
3    2620:112:f002:bbbb::21 (United States)

ASN6336 (TURN-US-ASN, US)
ad.turn.com
1    174.137.133.32 (United States)

ASN27257 (WEBAIR-INTERNET, US)
sync.adkernel.com
1    8.2.111.13 (United States)

ASN46636 (NATCOWEB, US)
cs.iqzone.com
8    74.121.140.211 (Reston, United States)

ASN30419 (MEDIAMATH-INC, US)
sync.mathtag.com
6    151.101.66.49 (United States)

ASN54113 (FASTLY, US)
sync-tm.everesttech.net
3    35.207.24.140 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 140.24.207.35.bc.googleusercontent.com
rtb.mfadsrvr.com
1    34.96.105.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com
tr.blismedia.com
1    213.19.162.90 (United Kingdom)

ASN3356 (LEVEL3, US)
pixel-eu.rubiconproject.com
1    51.222.39.187 (Canada)

ASN16276 (OVH, FR)
PTR: ip187.ip-51-222-39.net
onetag-sys.com
2    202.241.208.56 (Japan)

ASN4694 (IDCF IDC Frontier Inc., JP)
tg.socdm.com
1    80.77.87.161 (Clifton, United States)

ASN46636 (NATCOWEB, US)
cs.admanmedia.com
8    185.184.8.90 (Amsterdam, Netherlands)

ASN204995 (RTB-HOUSE-AMS, PL)
PTR: ip-185-184-8-90.rtbhouse.net
creativecdn.com
1    2607:f8b0:4004:c08::9d (Ashburn, United States)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
7    54.92.222.20 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-92-222-20.compute-1.amazonaws.com
i.liadm.com
2    18.198.251.95 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-251-95.eu-central-1.compute.amazonaws.com
ih.adscale.de
1    35.208.249.213 (Council Bluffs, United States)

ASN19527 (GOOGLE-2, US)
PTR: 213.249.208.35.bc.googleusercontent.com
trace.mediago.io
2    162.248.18.34 (United States)

ASN62713 (AS-PUBMATIC, US)
image4.pubmatic.com
30    23.105.14.106 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
PTR: 23.105.14.106.rdns.racklot.com
rtb-csync.smartadserver.com
4    74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)
dis.criteo.com
8    8.28.7.81 (United States)

ASN62713 (AS-PUBMATIC, US)
image6.pubmatic.com
2    50.57.31.206 (United States)

ASN19994 (RACKSPACE, US)
uipglob.semasio.net
1    204.62.13.72 (Clifton, United States)

ASN46636 (NATCOWEB, US)
inv-nets.admixer.net
1    82.145.213.8 (Norway)

ASN39832 (NO-OPERA, NO)
PTR: n-sysadmin-jumpbox-03.feednews.opera.technology
t.adx.opera.com
1    2620:112:f002:bbbb::23 (United States)

ASN6336 (TURN-US-ASN, US)
d.turn.com
2    2600:1f18:ed:550e:4106:3062:270c:cbbd (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
i6.liadm.com
2    108.138.106.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-17.jfk50.r.cloudfront.net
live.rezync.com
2    199.38.167.131 (United States)

ASN54312 (ROCKETFUEL, US)
p.rfihub.com
5    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
idsync.rlcdn.com
5    185.167.164.39 (Denmark)

ASN198622 (ADFORM, DK)
c1.adform.net
dmp.adform.net
9    52.85.61.67 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-67.ewr53.r.cloudfront.net
sopalk.com
12    151.101.65.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs.com
7    23.54.68.184 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-54-68-184.deploy.static.akamaitechnologies.com
cdn.adnxs.com
crcdn01.adnxs.com
22    68.67.160.75 (New York, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
nym1-ib.adnxs.com
2    34.196.255.49 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-255-49.compute-1.amazonaws.com
thrtle.com
4    8.43.72.97 (United States)

ASN26667 (RUBICONPROJECT, US)
token.rubiconproject.com
1    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
1    67.220.228.202 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
aax-eu.amazon-adsystem.com
1    2a04:4e42:400::300 (United States)

ASN54113 (FASTLY, US)
pips.taboola.com
1    141.226.224.32 (United States)

ASN200478 (TABOOLA-AS, IL)
cds.taboola.com
8    2606:4700:20::681a:a19 (United States)

ASN13335 (CLOUDFLARENET, US)
hb.adpone.com
5    34.206.101.164 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-206-101-164.compute-1.amazonaws.com
rtb.adentifi.com
8    37.157.6.233 (Denmark)

ASN198622 (ADFORM, DK)
adx.adform.net
79    172.67.10.198 (United States)

ASN13335 (CLOUDFLARENET, US)
prebid.smilewanted.com
csync.smilewanted.com
static.smilewanted.com
8    216.22.16.1 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
PTR: 216.22.16.1.servint.net
prg.smartadserver.com
2    54.84.64.172 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-84-64-172.compute-1.amazonaws.com
k.p-n.io
3    8.28.7.84 (United States)

ASN62713 (AS-PUBMATIC, US)
simage4.pubmatic.com
1    52.85.61.107 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-107.ewr53.r.cloudfront.net
cdn.callrail.com
2    35.171.239.119 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-239-119.compute-1.amazonaws.com
usermatch.krxd.net
2    3.234.237.251 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-234-237-251.compute-1.amazonaws.com
beacon.krxd.net
2    20.42.73.140 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dc.services.visualstudio.com
7    2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)
www.facebook.com
4    142.250.64.70 (Staten Island, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f6.1e100.net
ad.doubleclick.net
16    2607:f8b0:4006:80d::2001 (Flushing, United States)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
8    142.250.176.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f2.1e100.net
googleads4.g.doubleclick.net
6    2600:1400:9000::6875:b641 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)
cdn.doubleverify.com
4    2607:f8b0:4006:824::2006 (Flushing, United States)

ASN15169 (GOOGLE, US)
s0.2mdn.net
11    52.5.243.49 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-243-49.compute-1.amazonaws.com
match.prod.bidr.io
2    207.198.113.90 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
pixel-sync.sitescout.com
1    52.70.0.189 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-70-0-189.compute-1.amazonaws.com
sync.bfmio.com
1    54.229.88.75 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-229-88-75.eu-west-1.compute.amazonaws.com
synchroscript.deliveryengine.adswizz.com
2    38.98.69.175 (New York, United States)

ASN174 (COGENT-174, US)
pmp.mxptint.net
2    2604:9e00:1:129::2:a01 (United States)

ASN27257 (WEBAIR-INTERNET, US)
rtb2-useast.marketiq.com
1    174.137.133.49 (United States)

ASN27257 (WEBAIR-INTERNET, US)
dsp.adkernel.com
6    34.117.228.201 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 201.228.117.34.bc.googleusercontent.com
tps.doubleverify.com
tpsc-ue1.doubleverify.com
4    107.178.244.119 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 119.244.178.107.bc.googleusercontent.com
beacon.sojern.com
pixel.sojern.com
2    108.138.106.32 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-106-32.jfk50.r.cloudfront.net
choices.truste.com
4    13.85.16.224 (San Antonio, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
prod-dfm-proxy-connext.azurewebsites.net
1    151.101.129.108 (United States)

ASN54113 (FASTLY, US)
acdn.adnxs-simple.com
12    108.139.29.51 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-29-51.jfk50.r.cloudfront.net
choices.trustarc.com
2    34.95.69.49 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 49.69.95.34.bc.googleusercontent.com
i.clean.gg
1    195.244.31.10 (Newark, United States)

ASN63140 (IGUANA-WORLDWIDE, US)
visitor.omnitagjs.com
2    52.116.53.150 (United States)

ASN36351 (SOFTLAYER, US)
PTR: 96.35.7434.ip4.static.sl-reverse.com
8proof.com
2    54.205.17.152 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-17-152.compute-1.amazonaws.com
pm.w55c.net
1    69.90.254.78 (Herndon, United States)

ASN13768 (COGECO-PEER1, CA)
ums.acuityplatform.com
1    34.102.163.6 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 6.163.102.34.bc.googleusercontent.com
ad.mrtnsvr.com
2    2606:4700::6812:18ad (United States)

ASN13335 (CLOUDFLARENET, US)
a.tribalfusion.com
s.tribalfusion.com
1    172.104.105.5 (Tokyo, Japan)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1715-5.members.linode.com
gocm.c.appier.net
1    35.186.193.173 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com
ipac.ctnsnet.com
1    20.85.134.6 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
mweb.ck.inmobi.com
1    162.55.120.196 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.196.120.55.162.clients.your-server.de
matching.truffle.bid
1    195.5.165.20 (Slovenia)

ASN44968 (IPROM-AS, SI)
core.iprom.net
2    184.27.80.19 (Englewood, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a184-27-80-19.deploy.static.akamaitechnologies.com
px.owneriq.net
2    107.178.254.65 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com
1    34.98.67.3 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 3.67.98.34.bc.googleusercontent.com
tags.rd.linksynergy.com
1    34.203.16.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-203-16-231.compute-1.amazonaws.com
bpi.rtactivate.com
1    34.102.253.54 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 54.253.102.34.bc.googleusercontent.com
ads.playground.xyz
1    64.227.64.62 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)
match.adsby.bidtheatre.com
5    54.36.150.180 (France)

ASN16276 (OVH, FR)
PTR: ip180.ip-54-36-150.eu
cookie-matching.mediarithmics.com
18    138.201.8.249 (Ergolding, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.249.8.201.138.clients.your-server.de
sync.richaudience.com
8    96.46.186.57 (United States)

ASN7979 (SERVERS-COM, US)
ads.betweendigital.com
12    8.2.108.175 (United States)

ASN46636 (NATCOWEB, US)
us.ck-ie.com
7    37.157.6.243 (Denmark)

ASN198622 (ADFORM, DK)
cm.adform.net
2    2600:1f18:1c96:4103:9ee8:bc24:c1e4:34c4 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
sync.tidaltv.com
2    35.211.233.246 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 246.233.211.35.bc.googleusercontent.com
a.sportradarserving.com
2    54.161.170.61 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-161-170-61.compute-1.amazonaws.com
t.pswec.com
3    23.105.12.172 (Manassas, United States)

ASN30633 (LEASEWEB-USA-WDC, US)
sync.smartadserver.com
2    3.227.188.131 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-188-131.compute-1.amazonaws.com
ads.creative-serving.com
1    85.114.159.93 (Bad Durrheim, Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)
PTR: dsp.adfarm1.adition.com
dsp.adfarm1.adition.com
2    54.84.229.185 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-84-229-185.compute-1.amazonaws.com
io.narrative.io
4    52.44.244.58 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-244-58.compute-1.amazonaws.com
a.audrte.com
9    2606:4700:10::ac43:8ae (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.connectad.io
sync-eu.connectad.io
sync.connectad.io
1    34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com
s.company-target.com
Apex Domain
Subdomains		 Transfer
83 taboola.com
cdn.taboola.com — Cisco Umbrella Rank: 949
pm-widget.taboola.com — Cisco Umbrella Rank: 4879
trc.taboola.com — Cisco Umbrella Rank: 650
vidstat.taboola.com — Cisco Umbrella Rank: 2894
us-trc-events.taboola.com — Cisco Umbrella Rank: 6282
images.taboola.com — Cisco Umbrella Rank: 2011
imprnjmp.taboola.com — Cisco Umbrella Rank: 7873
us-match.taboola.com — Cisco Umbrella Rank: 7985
us-vid-events.taboola.com — Cisco Umbrella Rank: 7434
sync.taboola.com — Cisco Umbrella Rank: 1088
sync-t1.taboola.com — Cisco Umbrella Rank: 1302
match.taboola.com — Cisco Umbrella Rank: 5554
pips.taboola.com — Cisco Umbrella Rank: 1621
cds.taboola.com — Cisco Umbrella Rank: 1928
6 MB
80 pubmatic.com
hbopenbid.pubmatic.com — Cisco Umbrella Rank: 564
ads.pubmatic.com — Cisco Umbrella Rank: 547
image8.pubmatic.com — Cisco Umbrella Rank: 737
image2.pubmatic.com — Cisco Umbrella Rank: 1020
simage2.pubmatic.com — Cisco Umbrella Rank: 761
image4.pubmatic.com — Cisco Umbrella Rank: 1216
image6.pubmatic.com — Cisco Umbrella Rank: 822
simage4.pubmatic.com — Cisco Umbrella Rank: 1351
92 KB
79 smilewanted.com
prebid.smilewanted.com — Cisco Umbrella Rank: 6641
csync.smilewanted.com — Cisco Umbrella Rank: 3226
static.smilewanted.com — Cisco Umbrella Rank: 12179
110 KB
77 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 249
secure.adnxs.com — Cisco Umbrella Rank: 476
acdn.adnxs.com — Cisco Umbrella Rank: 611
cdn.adnxs.com — Cisco Umbrella Rank: 1701
nym1-ib.adnxs.com — Cisco Umbrella Rank: 1056
crcdn01.adnxs.com — Cisco Umbrella Rank: 11924
489 KB
62 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 219
googleads.g.doubleclick.net — Cisco Umbrella Rank: 57
cm.g.doubleclick.net — Cisco Umbrella Rank: 244
stats.g.doubleclick.net — Cisco Umbrella Rank: 124
ad.doubleclick.net — Cisco Umbrella Rank: 184
googleads4.g.doubleclick.net — Cisco Umbrella Rank: 359
564 KB
51 googlesyndication.com
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 133
tpc.googlesyndication.com — Cisco Umbrella Rank: 155
85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
284 KB
49 mercurynews.com
www.mercurynews.com — Cisco Umbrella Rank: 65849
a869.mercurynews.com — Cisco Umbrella Rank: 191725
session.mercurynews.com — Cisco Umbrella Rank: 236852
sli.mercurynews.com — Cisco Umbrella Rank: 281843
790 KB
44 smartadserver.com
ssbsync-us.smartadserver.com — Cisco Umbrella Rank: 8210
ssbsync.smartadserver.com — Cisco Umbrella Rank: 867
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 615
prg.smartadserver.com — Cisco Umbrella Rank: 1488
sync.smartadserver.com — Cisco Umbrella Rank: 1588
30 KB
41 rubiconproject.com
fastlane.rubiconproject.com — Cisco Umbrella Rank: 543
eus.rubiconproject.com — Cisco Umbrella Rank: 639
pixel-us-east.rubiconproject.com — Cisco Umbrella Rank: 1178
pixel-eu.rubiconproject.com — Cisco Umbrella Rank: 2421
secure-assets.rubiconproject.com — Cisco Umbrella Rank: 1134
pixel.rubiconproject.com — Cisco Umbrella Rank: 381
token.rubiconproject.com — Cisco Umbrella Rank: 656
109 KB
39 criteo.com
gum.criteo.com — Cisco Umbrella Rank: 407
bidder.criteo.com — Cisco Umbrella Rank: 742
mug.criteo.com — Cisco Umbrella Rank: 2114
dis.criteo.com — Cisco Umbrella Rank: 601
61 KB
28 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 357
aax.amazon-adsystem.com — Cisco Umbrella Rank: 444
s.amazon-adsystem.com — Cisco Umbrella Rank: 337
aax-eu.amazon-adsystem.com — Cisco Umbrella Rank: 1032
80 KB
25 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 361
11 KB
23 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 375
insight.adsrvr.org — Cisco Umbrella Rank: 592
15 KB
22 casalemedia.com
htlb.casalemedia.com — Cisco Umbrella Rank: 626
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 486
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 621
ssum.casalemedia.com — Cisco Umbrella Rank: 1386
dsum.casalemedia.com — Cisco Umbrella Rank: 1634
17 KB
21 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 618
14 KB
21 gumgum.com
rtb.gumgum.com — Cisco Umbrella Rank: 1673
usersync.gumgum.com — Cisco Umbrella Rank: 2018
7 KB
20 adform.net
c1.adform.net — Cisco Umbrella Rank: 635
adx.adform.net — Cisco Umbrella Rank: 4222
cm.adform.net — Cisco Umbrella Rank: 1254
dmp.adform.net — Cisco Umbrella Rank: 3522
9 KB
19 id5-sync.com
cdn.id5-sync.com — Cisco Umbrella Rank: 839
id5-sync.com — Cisco Umbrella Rank: 434
51 KB
18 richaudience.com
sync.richaudience.com — Cisco Umbrella Rank: 2090
5 KB
18 sharethrough.com
match.sharethrough.com — Cisco Umbrella Rank: 572
11 KB
16 google.com
accounts.google.com — Cisco Umbrella Rank: 59
adservice.google.com — Cisco Umbrella Rank: 107
www.google.com — Cisco Umbrella Rank: 3
79 KB
14 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 207
441 KB
13 liadm.com
b-code.liadm.com — Cisco Umbrella Rank: 2948
rp.liadm.com — Cisco Umbrella Rank: 2277
rp4.liadm.com — Cisco Umbrella Rank: 8165
i.liadm.com — Cisco Umbrella Rank: 671
i6.liadm.com — Cisco Umbrella Rank: 2341
26 KB
12 ck-ie.com
us.ck-ie.com — Cisco Umbrella Rank: 3354
6 KB
12 trustarc.com
choices.trustarc.com — Cisco Umbrella Rank: 918
47 KB
12 doubleverify.com
cdn.doubleverify.com — Cisco Umbrella Rank: 490
tps.doubleverify.com — Cisco Umbrella Rank: 516
tpsc-ue1.doubleverify.com — Cisco Umbrella Rank: 1435
320 KB
12 lijit.com
ap.lijit.com — Cisco Umbrella Rank: 772
ce.lijit.com — Cisco Umbrella Rank: 1036
11 KB
12 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 60
42 KB
11 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 602
6 KB
11 openx.net
us-u.openx.net — Cisco Umbrella Rank: 492
u.openx.net — Cisco Umbrella Rank: 740
eu-u.openx.net — Cisco Umbrella Rank: 2623
2 KB
11 yellowblue.io
cs-server-s2s.yellowblue.io — Cisco Umbrella Rank: 3980
cs.yellowblue.io — Cisco Umbrella Rank: 3215
6 KB
10 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1281
6 KB
10 criteo.net
static.criteo.net — Cisco Umbrella Rank: 583
276 KB
9 connectad.io
cdn.connectad.io — Cisco Umbrella Rank: 5633
sync-eu.connectad.io — Cisco Umbrella Rank: 4301
sync.connectad.io — Cisco Umbrella Rank: 5442
3 KB
9 sopalk.com
sopalk.com — Cisco Umbrella Rank: 63099
38 KB
9 yahoo.com
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 468
ups.analytics.yahoo.com — Cisco Umbrella Rank: 340
5 KB
9 clarium.io
protected-by.clarium.io — Cisco Umbrella Rank: 1555
2 KB
9 contextweb.com
bh.contextweb.com — Cisco Umbrella Rank: 648
8 KB
9 gstatic.com
fonts.gstatic.com
274 KB
9 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 80
ajax.googleapis.com — Cisco Umbrella Rank: 422
maps.googleapis.com — Cisco Umbrella Rank: 388
209 KB
8 betweendigital.com
ads.betweendigital.com — Cisco Umbrella Rank: 1846
5 KB
8 adpone.com
hb.adpone.com — Cisco Umbrella Rank: 22776
977 KB
8 creativecdn.com
creativecdn.com — Cisco Umbrella Rank: 498
2 KB
8 mathtag.com
sync.mathtag.com — Cisco Umbrella Rank: 566
4 KB
8 dotomi.com
amazon-tam-match.dotomi.com — Cisco Umbrella Rank: 5746
pulsepoint-match.dotomi.com — Cisco Umbrella Rank: 8602
pubmatic-match.dotomi.com — Cisco Umbrella Rank: 4315
casale-match.dotomi.com — Cisco Umbrella Rank: 3996
3 KB
8 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 513
1 KB
8 yieldmo.com
ads.yieldmo.com — Cisco Umbrella Rank: 689
sync-amz.ads.yieldmo.com — Cisco Umbrella Rank: 6466
sync-pm.ads.yieldmo.com — Cisco Umbrella Rank: 7222
5 KB
7 facebook.com
www.facebook.com — Cisco Umbrella Rank: 101
326 B
7 matheranalytics.com
js.matheranalytics.com — Cisco Umbrella Rank: 11816
www.i.matheranalytics.com — Cisco Umbrella Rank: 11436
45 KB
7 3lift.com
tlx.3lift.com — Cisco Umbrella Rank: 638
eb2.3lift.com — Cisco Umbrella Rank: 421
3 KB
7 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 1215
pixel.quantserve.com — Cisco Umbrella Rank: 977
cms.quantserve.com — Cisco Umbrella Rank: 846
11 KB
6 everesttech.net
sync-tm.everesttech.net — Cisco Umbrella Rank: 778
1 KB
6 stickyadstv.com
ads.stickyadstv.com — Cisco Umbrella Rank: 617
3 KB
6 zemanta.com
b1sync.zemanta.com — Cisco Umbrella Rank: 560
4 KB
6 scorecardresearch.com
sb.scorecardresearch.com — Cisco Umbrella Rank: 160
4 KB
6 sitescout.com
pixel.sitescout.com — Cisco Umbrella Rank: 3944
pixel-sync.sitescout.com — Cisco Umbrella Rank: 756
4 KB
6 remixd.com
tags.remixd.com — Cisco Umbrella Rank: 23147
pubcast-files.remixd.com — Cisco Umbrella Rank: 24886
player-files.remixd.com — Cisco Umbrella Rank: 23769
49 KB
5 mediarithmics.com
cookie-matching.mediarithmics.com — Cisco Umbrella Rank: 16668
2 KB
5 adentifi.com
rtb.adentifi.com — Cisco Umbrella Rank: 1337
35 B
5 rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 426
943 B
5 stackadapt.com
sync.srv.stackadapt.com — Cisco Umbrella Rank: 792
3 KB
5 postrelease.com
jadserve.postrelease.com — Cisco Umbrella Rank: 1322
4 KB
5 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 218
4 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 82
396 KB
5 osano.com
cmp.osano.com — Cisco Umbrella Rank: 6025
consent.api.osano.com — Cisco Umbrella Rank: 11374
82 KB
4 audrte.com
a.audrte.com — Cisco Umbrella Rank: 2906
3 KB
4 azurewebsites.net
prod-dfm-proxy-connext.azurewebsites.net — Cisco Umbrella Rank: 75189
2 KB
4 sojern.com
beacon.sojern.com — Cisco Umbrella Rank: 4829
pixel.sojern.com — Cisco Umbrella Rank: 7038
702 B
4 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 338
169 KB
4 krxd.net
usermatch.krxd.net — Cisco Umbrella Rank: 1650
beacon.krxd.net — Cisco Umbrella Rank: 637
1 KB
4 turn.com
ad.turn.com — Cisco Umbrella Rank: 1039
d.turn.com — Cisco Umbrella Rank: 1463
2 KB
4 loopme.me
csync.loopme.me — Cisco Umbrella Rank: 1024
1 KB
4 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 589
tags.bluekai.com — Cisco Umbrella Rank: 653
2 KB
4 google.ca
www.google.ca — Cisco Umbrella Rank: 7757
690 B
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 389
25 KB
4 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 176
329 KB
4 crwdcntrl.net
sync.crwdcntrl.net — Cisco Umbrella Rank: 948
bcp.crwdcntrl.net — Cisco Umbrella Rank: 952
2 KB
4 privacymanager.io
launchpad-wrapper.privacymanager.io — Cisco Umbrella Rank: 4219
launchpad.privacymanager.io — Cisco Umbrella Rank: 3796
geo.privacymanager.io — Cisco Umbrella Rank: 2038
11 KB
3 mfadsrvr.com
rtb.mfadsrvr.com — Cisco Umbrella Rank: 1160
1023 B
3 simpli.fi
um.simpli.fi — Cisco Umbrella Rank: 976
2 KB
3 adgrx.com
cm.adgrx.com — Cisco Umbrella Rank: 1615
2 KB
3 outbrain.com
sync.outbrain.com — Cisco Umbrella Rank: 763
1 KB
3 cognitivlabs.com
beacon.lynx.cognitivlabs.com — Cisco Umbrella Rank: 1669
1 KB
3 moatads.com
z.moatads.com — Cisco Umbrella Rank: 620
js.moatads.com — Cisco Umbrella Rank: 34305
s-jsonp.moatads.com — Cisco Umbrella Rank: 16941
55 KB
3 exelator.com
loadm.exelator.com — Cisco Umbrella Rank: 1685
load77.exelator.com — Cisco Umbrella Rank: 4389
2 KB
3 czx5eyk0exbhwp43ya.biz
cdn.czx5eyk0exbhwp43ya.biz — Cisco Umbrella Rank: 40869
781 KB
3 w.org
s.w.org — Cisco Umbrella Rank: 2154
3 KB
3 azureedge.net
loader-cdn.azureedge.net — Cisco Umbrella Rank: 28989
fp-cdn.azureedge.net — Cisco Umbrella Rank: 54391
g2insights-cdn.azureedge.net — Cisco Umbrella Rank: 52545
73 KB
3 blueconic.net
digitalfirstmedia.blueconic.net — Cisco Umbrella Rank: 107748
2 KB
3 p-n.io
cdn.p-n.io — Cisco Umbrella Rank: 4894
k.p-n.io — Cisco Umbrella Rank: 3105
58 KB
3 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 379
98 KB
2 narrative.io
io.narrative.io — Cisco Umbrella Rank: 5330
643 B
2 creative-serving.com
ads.creative-serving.com — Cisco Umbrella Rank: 4938
1 KB
2 pswec.com
t.pswec.com — Cisco Umbrella Rank: 4280
1 KB
2 sportradarserving.com
a.sportradarserving.com — Cisco Umbrella Rank: 2903
973 B
2 tidaltv.com
sync.tidaltv.com — Cisco Umbrella Rank: 1839
133 B
2 pippio.com
pippio.com — Cisco Umbrella Rank: 852
882 B
2 owneriq.net
px.owneriq.net — Cisco Umbrella Rank: 1856
1 KB
2 tribalfusion.com
a.tribalfusion.com — Cisco Umbrella Rank: 920
s.tribalfusion.com — Cisco Umbrella Rank: 2022
1 KB
2 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 1012
1 KB
2 8proof.com
8proof.com — Cisco Umbrella Rank: 38306
cdn.8proof.com Failed
3 KB
2 clean.gg
i.clean.gg — Cisco Umbrella Rank: 1363
104 B
2 truste.com
choices.truste.com — Cisco Umbrella Rank: 932
11 KB
2 marketiq.com
rtb2-useast.marketiq.com — Cisco Umbrella Rank: 5960
766 B
2 mxptint.net
pmp.mxptint.net — Cisco Umbrella Rank: 6777
967 B
2 visualstudio.com
dc.services.visualstudio.com — Cisco Umbrella Rank: 687
281 B
2 thrtle.com
thrtle.com — Cisco Umbrella Rank: 1466
684 B
2 addthis.com
x.dlx.addthis.com — Cisco Umbrella Rank: 1561
1 KB
2 rfihub.com
p.rfihub.com — Cisco Umbrella Rank: 933
2 KB
2 rezync.com
live.rezync.com — Cisco Umbrella Rank: 1583
1 KB
2 semasio.net
uipglob.semasio.net — Cisco Umbrella Rank: 1332
1 KB
2 adscale.de
ih.adscale.de — Cisco Umbrella Rank: 2994
633 B
2 socdm.com
tg.socdm.com — Cisco Umbrella Rank: 1091
2 KB
2 adkernel.com
sync.adkernel.com — Cisco Umbrella Rank: 1375
dsp.adkernel.com — Cisco Umbrella Rank: 9107
570 B
2 adroll.com
d.adroll.com — Cisco Umbrella Rank: 1432
361 B
2 360yield.com
ad.360yield.com — Cisco Umbrella Rank: 662
ice.360yield.com — Cisco Umbrella Rank: 2409 Failed
646 B
2 deepintent.com
match.deepintent.com — Cisco Umbrella Rank: 1163
594 B
2 technoratimedia.com
sync.technoratimedia.com — Cisco Umbrella Rank: 1587
4 KB
2 ipredictive.com
sync.ipredictive.com — Cisco Umbrella Rank: 1069
1019 B
2 kargo.com
crb.kargo.com — Cisco Umbrella Rank: 1801
939 B
2 media.net
cs.media.net — Cisco Umbrella Rank: 1628
contextual.media.net — Cisco Umbrella Rank: 645
1 KB
2 amazonaws.com
paywall-ad-bucket.s3.amazonaws.com — Cisco Umbrella Rank: 40997
ams-pageview-public.s3.amazonaws.com — Cisco Umbrella Rank: 13587
1 KB
2 pranmcpkx.com
cdn.pranmcpkx.com — Cisco Umbrella Rank: 29707
5 KB
2 foo.software
www.foo.software — Cisco Umbrella Rank: 68920
191 B
2 confiant-integrations.net
cdn.confiant-integrations.net — Cisco Umbrella Rank: 1546
101 KB
2 viafoura.co
api.viafoura.co — Cisco Umbrella Rank: 11496
i.viafoura.co — Cisco Umbrella Rank: 11514
3 KB
2 unpkg.com
unpkg.com — Cisco Umbrella Rank: 1035
3 KB
2 msecnd.net
az416426.vo.msecnd.net — Cisco Umbrella Rank: 2417
45 KB
2 wp.com
stats.wp.com — Cisco Umbrella Rank: 3092
pixel.wp.com — Cisco Umbrella Rank: 2850
5 KB
2 parsely.com
cdn.parsely.com — Cisco Umbrella Rank: 3107
p1.parsely.com — Cisco Umbrella Rank: 2311
21 KB
2 htlbid.com
htlbid.com — Cisco Umbrella Rank: 11396
110 KB
1 company-target.com
s.company-target.com — Cisco Umbrella Rank: 2002
424 B
1 adition.com
dsp.adfarm1.adition.com — Cisco Umbrella Rank: 1651
487 B
1 bidtheatre.com
match.adsby.bidtheatre.com — Cisco Umbrella Rank: 2846
555 B
1 playground.xyz
ads.playground.xyz — Cisco Umbrella Rank: 4922
466 B
1 rtactivate.com
bpi.rtactivate.com — Cisco Umbrella Rank: 1881
109 B
1 linksynergy.com
tags.rd.linksynergy.com — Cisco Umbrella Rank: 4739
393 B
1 iprom.net
core.iprom.net — Cisco Umbrella Rank: 7132
279 B
1 truffle.bid
matching.truffle.bid — Cisco Umbrella Rank: 8501
1 inmobi.com
mweb.ck.inmobi.com — Cisco Umbrella Rank: 4691
350 B
1 ctnsnet.com
ipac.ctnsnet.com — Cisco Umbrella Rank: 6665
370 B
1 appier.net
gocm.c.appier.net — Cisco Umbrella Rank: 2634
436 B
1 mrtnsvr.com
ad.mrtnsvr.com — Cisco Umbrella Rank: 3053
308 B
1 acuityplatform.com
ums.acuityplatform.com — Cisco Umbrella Rank: 1501
674 B
1 omnitagjs.com
visitor.omnitagjs.com — Cisco Umbrella Rank: 962
387 B
1 adnxs-simple.com
acdn.adnxs-simple.com — Cisco Umbrella Rank: 2129
43 KB
1 adswizz.com
synchroscript.deliveryengine.adswizz.com — Cisco Umbrella Rank: 3020
397 B
1 bfmio.com
sync.bfmio.com — Cisco Umbrella Rank: 1630
425 B
1 callrail.com
cdn.callrail.com — Cisco Umbrella Rank: 8395
37 KB
1 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 408
734 B
1 opera.com
t.adx.opera.com — Cisco Umbrella Rank: 3272
467 B
1 admixer.net
inv-nets.admixer.net — Cisco Umbrella Rank: 2637
583 B
1 mediago.io
trace.mediago.io — Cisco Umbrella Rank: 1105
188 B
1 admanmedia.com
cs.admanmedia.com — Cisco Umbrella Rank: 1103
1 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 874
815 B
1 blismedia.com
tr.blismedia.com — Cisco Umbrella Rank: 2376
172 B
1 iqzone.com
cs.iqzone.com — Cisco Umbrella Rank: 1868
1 33across.com
ssc-cms.33across.com — Cisco Umbrella Rank: 1154
503 B
1 sonobi.com
sync.go.sonobi.com — Cisco Umbrella Rank: 1089
754 B
1 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 805
530 B
1 myastrology.com
track.elissa.myastrology.com — Cisco Umbrella Rank: 68968
1 KB
1 db-ip.com
api-mg2.db-ip.com — Cisco Umbrella Rank: 25049
791 B
1 thebrighttag.com
s.thebrighttag.com — Cisco Umbrella Rank: 2009
14 KB
1 jwplayer.com
cdn.jwplayer.com — Cisco Umbrella Rank: 2864
41 KB
1 ntv.io
s.ntv.io — Cisco Umbrella Rank: 3801
157 KB
1 teads.tv
sync.teads.tv — Cisco Umbrella Rank: 1404
279 B
1 btstatic.com
s.btstatic.com — Cisco Umbrella Rank: 9849
13 KB
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 1141
448 B
1 uidapi.com
cdn.prod.uidapi.com — Cisco Umbrella Rank: 1509
2 KB
1 polyfill.io
polyfill.io — Cisco Umbrella Rank: 1711
669 B
1 viafoura.net
cdn.viafoura.net — Cisco Umbrella Rank: 10590
13 KB
1 windows.net
prodmg2.blob.core.windows.net — Cisco Umbrella Rank: 64719
144 KB
1 auth0.com
cdn.auth0.com — Cisco Umbrella Rank: 7635
38 KB
999 173
Domain Requested by
65 csync.smilewanted.com 3 redirects hb.adpone.com
csync.smilewanted.com
www.mercurynews.com
sync-eu.connectad.io
30 rtb-csync.smartadserver.com 6 redirects www.mercurynews.com
csync.smilewanted.com
30 ib.adnxs.com 6 redirects htlbid.com
acdn.adnxs.com
hb.adpone.com
csync.smilewanted.com
28 cm.g.doubleclick.net 21 redirects rtb.gumgum.com
www.mercurynews.com
eus.rubiconproject.com
u.openx.net
28 www.mercurynews.com 1 redirects www.mercurynews.com
cmp.osano.com
26 cdn.taboola.com cmp.osano.com
www.mercurynews.com
25 x.bidswitch.net 25 redirects
25 images.taboola.com www.mercurynews.com
24 pagead2.googlesyndication.com az416426.vo.msecnd.net
ad.doubleclick.net
tpc.googlesyndication.com
www.googletagservices.com
securepubads.g.doubleclick.net
acdn.adnxs-simple.com
23 simage2.pubmatic.com 7 redirects s.amazon-adsystem.com
ads.pubmatic.com
23 s.amazon-adsystem.com 2 redirects cmp.osano.com
s.amazon-adsystem.com
rtb.gumgum.com
ssum-sec.casalemedia.com
match.sharethrough.com
bh.contextweb.com
cs-server-s2s.yellowblue.io
sync-amz.ads.yieldmo.com
ce.lijit.com
eus.rubiconproject.com
ads.pubmatic.com
u.openx.net
22 nym1-ib.adnxs.com www.mercurynews.com
cdn.adnxs.com
hb.adpone.com
sopalk.com
acdn.adnxs-simple.com
21 sync.1rx.io 21 redirects
20 match.adsrvr.org 19 redirects
19 usersync.gumgum.com 1 redirects rtb.gumgum.com
eus.rubiconproject.com
ads.pubmatic.com
18 sync.richaudience.com 13 redirects csync.smilewanted.com
18 eus.rubiconproject.com s.amazon-adsystem.com
eus.rubiconproject.com
cs-server-s2s.yellowblue.io
rtb.gumgum.com
hb.adpone.com
www.mercurynews.com
18 match.sharethrough.com 12 redirects s.amazon-adsystem.com
match.sharethrough.com
18 id5-sync.com 17 redirects cdn.id5-sync.com
18 gum.criteo.com 8 redirects cmp.osano.com
www.mercurynews.com
static.criteo.net
18 securepubads.g.doubleclick.net www.mercurynews.com
cmp.osano.com
securepubads.g.doubleclick.net
az416426.vo.msecnd.net
www.googletagservices.com
16 tpc.googlesyndication.com cmp.osano.com
ad.doubleclick.net
tpc.googlesyndication.com
www.mercurynews.com
85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
acdn.adnxs-simple.com
16 a869.mercurynews.com www.mercurynews.com
a869.mercurynews.com
cmp.osano.com
14 image8.pubmatic.com 12 redirects ads.pubmatic.com
14 www.googletagservices.com www.mercurynews.com
www.googletagservices.com
ad.doubleclick.net
acdn.adnxs-simple.com
85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
12 us.ck-ie.com 12 redirects
12 choices.trustarc.com choices.truste.com
choices.trustarc.com
12 acdn.adnxs.com www.mercurynews.com
sopalk.com
hb.adpone.com
12 www.google-analytics.com cmp.osano.com
www.googletagmanager.com
az416426.vo.msecnd.net
www.google-analytics.com
11 match.prod.bidr.io 11 redirects
11 image2.pubmatic.com 4 redirects cs-server-s2s.yellowblue.io
sync-amz.ads.yieldmo.com
ads.pubmatic.com
s.amazon-adsystem.com
11 dsum-sec.casalemedia.com 1 redirects ssum-sec.casalemedia.com
ssum.casalemedia.com
10 sync.taboola.com 3 redirects www.mercurynews.com
10 sync.targeting.unrulymedia.com 8 redirects csync.smilewanted.com
10 ads.pubmatic.com s.amazon-adsystem.com
rtb.gumgum.com
hb.adpone.com
www.mercurynews.com
sync-eu.connectad.io
10 static.criteo.net cmp.osano.com
az416426.vo.msecnd.net
www.mercurynews.com
hb.adpone.com
static.criteo.net
9 sopalk.com www.mercurynews.com
sopalk.com
cmp.osano.com
9 pixel.rubiconproject.com 6 redirects eus.rubiconproject.com
9 protected-by.clarium.io www.mercurynews.com
9 bh.contextweb.com 5 redirects s.amazon-adsystem.com
bh.contextweb.com
www.mercurynews.com
9 002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com cmp.osano.com
9 hbopenbid.pubmatic.com htlbid.com
hb.adpone.com
9 bidder.criteo.com htlbid.com
hb.adpone.com
9 fonts.gstatic.com fonts.googleapis.com
8 ads.betweendigital.com 8 redirects
8 googleads4.g.doubleclick.net ad.doubleclick.net
acdn.adnxs-simple.com
8 prg.smartadserver.com hb.adpone.com
8 prebid.smilewanted.com hb.adpone.com
8 adx.adform.net hb.adpone.com
8 hb.adpone.com www.mercurynews.com
sopalk.com
8 image6.pubmatic.com 4 redirects ads.pubmatic.com
8 creativecdn.com 8 redirects
8 sync.mathtag.com 7 redirects i.liadm.com
8 mug.criteo.com www.mercurynews.com
8 pixel.tapad.com 4 redirects www.mercurynews.com
sync-amz.ads.yieldmo.com
s.amazon-adsystem.com
7 cm.adform.net 7 redirects
7 www.facebook.com
7 i.liadm.com 4 redirects cmp.osano.com
i.liadm.com
7 us-u.openx.net 3 redirects u.openx.net
7 cs-server-s2s.yellowblue.io s.amazon-adsystem.com
cs-server-s2s.yellowblue.io
7 ce.lijit.com 1 redirects s.amazon-adsystem.com
ce.lijit.com
www.mercurynews.com
7 www.google.com www.mercurynews.com
cmp.osano.com
85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
6 sync.connectad.io sync-eu.connectad.io
u.openx.net
ssum.casalemedia.com
ads.pubmatic.com
6 static.smilewanted.com csync.smilewanted.com
6 cdn.doubleverify.com ad.doubleclick.net
www.mercurynews.com
acdn.adnxs-simple.com
6 cdn.adnxs.com www.mercurynews.com
hb.adpone.com
6 sync-tm.everesttech.net 5 redirects ads.pubmatic.com
6 ads.stickyadstv.com 6 redirects
6 pr-bh.ybp.yahoo.com 3 redirects u.openx.net
ssum.casalemedia.com
6 b1sync.zemanta.com 6 redirects
6 secure.adnxs.com 3 redirects www.mercurynews.com
sopalk.com
6 eb2.3lift.com 3 redirects www.mercurynews.com
s.amazon-adsystem.com
6 ssum-sec.casalemedia.com 1 redirects s.amazon-adsystem.com
rtb.gumgum.com
ssum-sec.casalemedia.com
6 adservice.google.com cmp.osano.com
www.mercurynews.com
6 ads.yieldmo.com 1 redirects htlbid.com
sync-amz.ads.yieldmo.com
www.mercurynews.com
6 sb.scorecardresearch.com 2 redirects www.mercurynews.com
cmp.osano.com
5 cookie-matching.mediarithmics.com 5 redirects
5 rtb.adentifi.com www.mercurynews.com
ads.pubmatic.com
5 idsync.rlcdn.com 3 redirects i.liadm.com
5 cms.quantserve.com 5 redirects
5 sync.srv.stackadapt.com 5 redirects
5 ap.lijit.com 5 redirects
5 jadserve.postrelease.com cmp.osano.com
www.mercurynews.com
5 www.i.matheranalytics.com www.mercurynews.com
5 trc.taboola.com cdn.taboola.com
www.mercurynews.com
az416426.vo.msecnd.net
5 dpm.demdex.net 3 redirects www.mercurynews.com
i.liadm.com
5 www.googletagmanager.com cmp.osano.com
4 a.audrte.com 3 redirects
4 prod-dfm-proxy-connext.azurewebsites.net cdn.czx5eyk0exbhwp43ya.biz
4 s0.2mdn.net sopalk.com
acdn.adnxs-simple.com
ad.doubleclick.net
4 ad.doubleclick.net www.googletagservices.com
acdn.adnxs-simple.com
4 token.rubiconproject.com 4 redirects
4 c1.adform.net 4 redirects
4 dis.criteo.com 4 redirects
4 csync.loopme.me 4 redirects
4 cs.yellowblue.io cs-server-s2s.yellowblue.io
eus.rubiconproject.com
4 www.google.ca www.mercurynews.com
4 bat.bing.com cmp.osano.com
4 us-trc-events.taboola.com www.mercurynews.com
4 connect.facebook.net cmp.osano.com
4 fastlane.rubiconproject.com htlbid.com
hb.adpone.com
4 pixel.sitescout.com 2 redirects www.mercurynews.com
4 session.mercurynews.com www.mercurynews.com
4 maps.googleapis.com www.mercurynews.com
maps.googleapis.com
cmp.osano.com
4 fonts.googleapis.com www.mercurynews.com
cmp.osano.com
3 sync.smartadserver.com 3 redirects
3 tpsc-ue1.doubleverify.com cdn.doubleverify.com
3 tps.doubleverify.com cdn.doubleverify.com
www.mercurynews.com
3 insight.adsrvr.org 3 redirects
3 simage4.pubmatic.com ads.pubmatic.com
3 u.openx.net 1 redirects www.mercurynews.com
sync-eu.connectad.io
3 sync-t1.taboola.com www.mercurynews.com
3 rtb.mfadsrvr.com 3 redirects
3 ad.turn.com 3 redirects
3 pixel-us-east.rubiconproject.com 3 redirects
3 ups.analytics.yahoo.com 3 redirects
3 um.simpli.fi 3 redirects
3 cm.adgrx.com 3 redirects
3 sync.outbrain.com 3 redirects
3 stags.bluekai.com 3 redirects
3 beacon.lynx.cognitivlabs.com 2 redirects ads.pubmatic.com
3 player-files.remixd.com www.mercurynews.com
3 googleads.g.doubleclick.net cmp.osano.com
3 sync.crwdcntrl.net 1 redirects www.mercurynews.com
3 cdn.czx5eyk0exbhwp43ya.biz cmp.osano.com
cdn.czx5eyk0exbhwp43ya.biz
3 s.w.org www.mercurynews.com
3 c.amazon-adsystem.com cmp.osano.com
c.amazon-adsystem.com
3 digitalfirstmedia.blueconic.net a869.mercurynews.com
cmp.osano.com
3 cmp.osano.com www.mercurynews.com
cmp.osano.com
3 accounts.google.com www.mercurynews.com
cmp.osano.com
accounts.google.com
3 cdn.jsdelivr.net www.mercurynews.com
cdn.jsdelivr.net
cmp.osano.com
2 casale-match.dotomi.com 2 redirects
2 sync-eu.connectad.io cdn.connectad.io
sync-eu.connectad.io
2 io.narrative.io 1 redirects
2 ads.creative-serving.com 2 redirects
2 t.pswec.com 2 redirects
2 a.sportradarserving.com 2 redirects
2 sync.tidaltv.com hb.adpone.com
2 pippio.com 2 redirects
2 px.owneriq.net 2 redirects
2 pm.w55c.net 2 redirects
2 8proof.com www.mercurynews.com
85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
2 i.clean.gg acdn.adnxs-simple.com
2 pixel.sojern.com 2 redirects
2 85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com www.mercurynews.com
2 choices.truste.com hb.adpone.com
ad.doubleclick.net
2 beacon.sojern.com hb.adpone.com
sopalk.com
2 rtb2-useast.marketiq.com 2 redirects
2 pmp.mxptint.net 1 redirects
2 pubmatic-match.dotomi.com 2 redirects
2 pixel-sync.sitescout.com 2 redirects
2 dc.services.visualstudio.com az416426.vo.msecnd.net
2 beacon.krxd.net
2 usermatch.krxd.net 2 redirects
2 k.p-n.io cdn.p-n.io
2 dsum.casalemedia.com 1 redirects ssum.casalemedia.com
2 thrtle.com 1 redirects s.amazon-adsystem.com
2 x.dlx.addthis.com 1 redirects i.liadm.com
2 p.rfihub.com 2 redirects
2 live.rezync.com 2 redirects
2 i6.liadm.com i.liadm.com
2 uipglob.semasio.net 2 redirects
2 image4.pubmatic.com 1 redirects www.mercurynews.com
2 ih.adscale.de 2 redirects
2 tg.socdm.com 2 redirects
2 secure-assets.rubiconproject.com 2 redirects
2 us-match.taboola.com cmp.osano.com
2 pulsepoint-match.dotomi.com 2 redirects
2 ssum.casalemedia.com 1 redirects sync-eu.connectad.io
2 d.adroll.com ssum-sec.casalemedia.com
ssum.casalemedia.com
2 ssbsync.smartadserver.com 1 redirects www.mercurynews.com
2 ad.360yield.com 2 redirects
2 match.deepintent.com 1 redirects rtb.gumgum.com
2 sync.technoratimedia.com 2 redirects
2 sync.ipredictive.com 2 redirects
2 crb.kargo.com s.amazon-adsystem.com
2 amazon-tam-match.dotomi.com 2 redirects
2 rtb.gumgum.com 1 redirects s.amazon-adsystem.com
2 geo.privacymanager.io launchpad.privacymanager.io
2 cdn.pranmcpkx.com cmp.osano.com
2 b-code.liadm.com cmp.osano.com
2 consent.api.osano.com cmp.osano.com
2 loadm.exelator.com 2 redirects
2 js.matheranalytics.com 1 redirects www.mercurynews.com
2 pm-widget.taboola.com cmp.osano.com
2 www.foo.software www.mercurynews.com
2 cdn.confiant-integrations.net cmp.osano.com
2 unpkg.com 1 redirects www.mercurynews.com
2 az416426.vo.msecnd.net www.mercurynews.com
cmp.osano.com
2 tags.remixd.com www.mercurynews.com
tags.remixd.com
2 htlbid.com www.mercurynews.com
1 s.company-target.com 1 redirects
1 cdn.connectad.io csync.smilewanted.com
1 dmp.adform.net 1 redirects
1 dsp.adfarm1.adition.com 1 redirects
1 eu-u.openx.net 1 redirects
1 match.adsby.bidtheatre.com 1 redirects
1 ads.playground.xyz 1 redirects
1 bpi.rtactivate.com
1 bcp.crwdcntrl.net
1 tags.rd.linksynergy.com 1 redirects
1 core.iprom.net ads.pubmatic.com
1 matching.truffle.bid ads.pubmatic.com
1 mweb.ck.inmobi.com 1 redirects
1 ipac.ctnsnet.com ads.pubmatic.com
1 gocm.c.appier.net 1 redirects
1 s.tribalfusion.com ads.pubmatic.com
1 a.tribalfusion.com 1 redirects
1 ad.mrtnsvr.com 1 redirects
1 ums.acuityplatform.com 1 redirects
1 visitor.omnitagjs.com 1 redirects
1 acdn.adnxs-simple.com hb.adpone.com
1 crcdn01.adnxs.com hb.adpone.com
1 dsp.adkernel.com 1 redirects
1 synchroscript.deliveryengine.adswizz.com
1 sync.bfmio.com
1 tags.bluekai.com 1 redirects
1 cdn.callrail.com cmp.osano.com
1 s-jsonp.moatads.com cmp.osano.com
1 cds.taboola.com az416426.vo.msecnd.net
1 pips.taboola.com az416426.vo.msecnd.net
1 aax-eu.amazon-adsystem.com eus.rubiconproject.com
1 px.ads.linkedin.com eus.rubiconproject.com
1 d.turn.com 1 redirects
1 t.adx.opera.com www.mercurynews.com
1 match.taboola.com www.mercurynews.com
1 inv-nets.admixer.net 1 redirects
1 sync-pm.ads.yieldmo.com www.mercurynews.com
1 trace.mediago.io 1 redirects
1 stats.g.doubleclick.net az416426.vo.msecnd.net
1 cs.admanmedia.com rtb.gumgum.com
1 onetag-sys.com cs-server-s2s.yellowblue.io
1 pixel-eu.rubiconproject.com 1 redirects
1 tr.blismedia.com ce.lijit.com
1 cs.iqzone.com rtb.gumgum.com
1 sync.adkernel.com rtb.gumgum.com
1 us-vid-events.taboola.com www.mercurynews.com
1 imprnjmp.taboola.com cmp.osano.com
1 ssc-cms.33across.com 1 redirects
1 sync.go.sonobi.com 1 redirects
1 contextual.media.net cs-server-s2s.yellowblue.io
1 js.moatads.com www.mercurynews.com
1 z.moatads.com cmp.osano.com
1 sli.mercurynews.com www.mercurynews.com
1 sync-amz.ads.yieldmo.com s.amazon-adsystem.com
1 ssbsync-us.smartadserver.com 1 redirects
1 s.ad.smaato.net 1 redirects
1 cs.media.net 1 redirects
1 rp4.liadm.com www.mercurynews.com
1 rp.liadm.com 1 redirects
1 track.elissa.myastrology.com www.mercurynews.com
1 vidstat.taboola.com cmp.osano.com
1 ams-pageview-public.s3.amazonaws.com www.mercurynews.com
1 paywall-ad-bucket.s3.amazonaws.com www.mercurynews.com
1 api-mg2.db-ip.com fp-cdn.azureedge.net
1 launchpad.privacymanager.io cmp.osano.com
1 pixel.quantserve.com www.mercurynews.com
1 s.thebrighttag.com cmp.osano.com
1 cdn.jwplayer.com tags.remixd.com
1 s.ntv.io cmp.osano.com
1 sync.teads.tv www.mercurynews.com
1 load77.exelator.com www.mercurynews.com
1 s.btstatic.com cmp.osano.com
1 rules.quantcount.com cmp.osano.com
1 g2insights-cdn.azureedge.net cmp.osano.com
1 fp-cdn.azureedge.net cmp.osano.com
1 cdn.prod.uidapi.com cmp.osano.com
1 cdn.id5-sync.com cmp.osano.com
1 aax.amazon-adsystem.com c.amazon-adsystem.com
1 htlb.casalemedia.com htlbid.com
1 tlx.3lift.com htlbid.com
1 i.viafoura.co www.mercurynews.com
1 launchpad-wrapper.privacymanager.io cmp.osano.com
1 secure.quantserve.com cmp.osano.com
1 pixel.wp.com www.mercurynews.com
1 api.viafoura.co cdn.viafoura.net
1 loader-cdn.azureedge.net ajax.googleapis.com
1 pubcast-files.remixd.com tags.remixd.com
1 p1.parsely.com www.mercurynews.com
1 polyfill.io ajax.googleapis.com
1 stats.wp.com www.mercurynews.com
1 cdn.viafoura.net www.mercurynews.com
1 cdn.parsely.com www.mercurynews.com
1 prodmg2.blob.core.windows.net www.mercurynews.com
1 cdn.p-n.io www.mercurynews.com
1 cdn.auth0.com www.mercurynews.com
1 ajax.googleapis.com www.mercurynews.com
0 ice.360yield.com Failed csync.smilewanted.com
0 cdn.8proof.com Failed 8proof.com
999 289
Subject Issuer Validity Valid
mercurynews.com
R3		 2023-05-21 -
2023-08-19		 3 months crt.sh
htlbid.com
Amazon RSA 2048 M01		 2023-02-21 -
2023-11-19		 9 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-12-23 -
2024-01-24		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.auth0.com
Amazon RSA 2048 M01		 2023-02-24 -
2024-03-24		 a year crt.sh
accounts.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
pushlycdn.com
Amazon RSA 2048 M02		 2023-02-27 -
2024-02-13		 a year crt.sh
s762.pressenterprise.com
Amazon RSA 2048 M02		 2023-02-21 -
2023-11-02		 8 months crt.sh
cmp.osano.com
Amazon RSA 2048 M02		 2023-02-21 -
2023-09-30		 7 months crt.sh
*.blob.core.windows.net
Microsoft RSA TLS CA 01		 2023-03-20 -
2024-03-20		 a year crt.sh
*.remixd.com
Amazon RSA 2048 M02		 2023-02-09 -
2024-03-09		 a year crt.sh
*.parsely.com
Amazon RSA 2048 M02		 2023-05-06 -
2024-06-03		 a year crt.sh
viafoura.com
Amazon RSA 2048 M01		 2023-02-28 -
2023-10-06		 7 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.wp.com
Sectigo ECC Domain Validation Secure Server CA		 2022-11-14 -
2023-12-15		 a year crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2023-05-05 -
2024-04-28		 a year crt.sh
polyfill.io
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-12-10 -
2024-01-11		 a year crt.sh
*.mercurynews.com
Amazon RSA 2048 M01		 2023-03-30 -
2024-04-28		 a year crt.sh
*.blueconic.net
Amazon RSA 2048 M01		 2023-06-08 -
2024-07-06		 a year crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-12-08 -
2023-12-31		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
pubcast-files.remixd.com
GTS CA 1D4		 2023-05-25 -
2023-08-23		 3 months crt.sh
c.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-02-28 -
2024-02-17		 a year crt.sh
*.w.org
Sectigo ECC Domain Validation Secure Server CA		 2022-12-06 -
2024-01-06		 a year crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-08-09 -
2023-09-09		 a year crt.sh
*.sitescout.com
GeoTrust Global TLS RSA4096 SHA256 2022 CA1		 2023-01-09 -
2024-02-02		 a year crt.sh
confiant-integrations.net
GTS CA 1P5		 2023-05-25 -
2023-08-23		 3 months crt.sh
*.privacymanager.io
Amazon RSA 2048 M02		 2023-02-22 -
2023-09-24		 7 months crt.sh
www.foo.software
Go Daddy Secure Certificate Authority - G2		 2022-12-29 -
2024-01-30		 a year crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-05-12 -
2023-08-10		 3 months crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-03-05 -
2024-04-03		 a year crt.sh
*.3lift.com
Amazon RSA 2048 M02		 2023-04-13 -
2024-05-11		 a year crt.sh
*.yieldmo.com
Amazon RSA 2048 M02		 2023-02-28 -
2023-10-12		 7 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018		 2023-02-13 -
2024-03-15		 a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2022-06-13 -
2023-07-14		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-05-22 -
2024-05-21		 a year crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-03-16 -
2024-03-08		 a year crt.sh
cdn.prod.uidapi.com
R3		 2023-05-18 -
2023-08-16		 3 months crt.sh
*.criteo.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-05-27 -
2023-08-27		 3 months crt.sh
snibe7egl.wpc.edgecastcdn.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-03 -
2024-02-03		 a year crt.sh
quantserve.com
R3		 2023-06-13 -
2023-09-11		 3 months crt.sh
s.btstatic.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-01-30 -
2024-02-20		 a year crt.sh
teads.tv
R3		 2023-05-11 -
2023-08-09		 3 months crt.sh
*.api.osano.com
Amazon RSA 2048 M01		 2023-02-24 -
2023-09-26		 7 months crt.sh
*.ntv.io
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-24 -
2023-10-26		 a year crt.sh
*.liadm.com
Amazon RSA 2048 M02		 2023-02-28 -
2024-01-30		 a year crt.sh
*.scorecardresearch.com
Sectigo RSA Domain Validation Secure Server CA		 2022-12-15 -
2023-12-28		 a year crt.sh
jwplayer.com
Amazon RSA 2048 M02		 2023-03-01 -
2023-12-25		 10 months crt.sh
*.id5-sync.com
R3		 2023-04-18 -
2023-07-17		 3 months crt.sh
signal.co
Entrust Certification Authority - L1K		 2023-02-10 -
2024-02-10		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-03-30 -
2023-06-28		 3 months crt.sh
www.i.matheranalytics.com
Amazon RSA 2048 M01		 2023-03-02 -
2024-01-13		 10 months crt.sh
s.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-03-03 -
2024-02-19		 a year crt.sh
player-files.remixd.com
GTS CA 1D4		 2023-06-02 -
2023-08-31		 3 months crt.sh
sni2bf2agl.wpc.edgecastcdn.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-10-31 -
2023-11-02		 a year crt.sh
*.s3.amazonaws.com
Amazon RSA 2048 M01		 2023-03-21 -
2023-12-19		 9 months crt.sh
track.elissa.myastrology.com
R3		 2023-06-06 -
2023-09-04		 3 months crt.sh
*.postrelease.com
Amazon RSA 2048 M01		 2023-03-01 -
2023-12-25		 10 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2023-02-16 -
2023-08-16		 6 months crt.sh
*.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.google.ca
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
gumgum.com
Amazon RSA 2048 M02		 2023-06-07 -
2024-07-06		 a year crt.sh
casalemedia.com
Go Daddy Secure Certificate Authority - G2		 2022-12-13 -
2024-01-13		 a year crt.sh
*.sharethrough.com
Amazon RSA 2048 M01		 2023-06-14 -
2024-07-12		 a year crt.sh
*.ads.yieldmo.com
Amazon RSA 2048 M01		 2023-03-26 -
2024-04-23		 a year crt.sh
*.contextweb.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-04-10 -
2024-05-09		 a year crt.sh
*.app.kargo.com
Amazon RSA 2048 M02		 2023-02-21 -
2024-01-18		 a year crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2023-05-06 -
2024-05-04		 a year crt.sh
*.yellowblue.io
Amazon ECDSA 256 M02		 2023-04-18 -
2024-05-16		 a year crt.sh
sli.bayareanewsgroup.com
R3		 2023-04-14 -
2023-07-13		 3 months crt.sh
moatads.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-11-16 -
2023-11-18		 a year crt.sh
a248.e.akamai.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-05-16 -
2024-05-15		 a year crt.sh
protected-by.clarium.io
Amazon RSA 2048 M01		 2022-12-16 -
2024-01-14		 a year crt.sh
*.deepintent.com
Go Daddy Secure Certificate Authority - G2		 2022-11-30 -
2024-01-01		 a year crt.sh
d.adroll.com
Amazon RSA 2048 M01		 2022-11-08 -
2023-12-07		 a year crt.sh
*.media.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-10 -
2024-02-18		 a year crt.sh
*.adkernel.com
AlphaSSL CA - SHA256 - G4		 2023-01-03 -
2024-02-04		 a year crt.sh
*.iqzone.com
Go Daddy Secure Certificate Authority - G2		 2023-04-05 -
2024-05-06		 a year crt.sh
*.ad-server.k8s.ggops.com
Amazon RSA 2048 M01		 2023-02-28 -
2024-02-09		 a year crt.sh
tr.blismedia.com
GTS CA 1D4		 2023-06-09 -
2023-09-07		 3 months crt.sh
*.onetag-sys.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-12-28 -
2024-01-28		 a year crt.sh
*.admanmedia.com
Go Daddy Secure Certificate Authority - G2		 2023-04-20 -
2024-05-21		 a year crt.sh
*.smartadserver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-01-21 -
2024-01-23		 a year crt.sh
*.openx.net
GeoTrust RSA CA 2018		 2022-07-21 -
2023-08-21		 a year crt.sh
*.adx.opera.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-05-22 -
2024-06-20		 a year crt.sh
*.mathtag.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-03-30 -
2024-04-29		 a year crt.sh
*.demdex.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-26 -
2023-10-27		 a year crt.sh
sopalk.com
Amazon RSA 2048 M01		 2023-02-24 -
2023-10-02		 7 months crt.sh
cdn.adnxs.com
GeoTrust TLS RSA CA G1		 2023-03-27 -
2024-04-26		 a year crt.sh
*.everesttech.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-11-07 -
2023-12-09		 a year crt.sh
aax-eu.amazon-adsystem.com
Amazon RSA 2048 M01		 2023-01-27 -
2024-01-27		 a year crt.sh
track.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-20 -
2023-09-20		 a year crt.sh
*.p-n.io
Amazon RSA 2048 M01		 2023-02-27 -
2024-01-21		 a year crt.sh
swappy.callrail.com
Amazon RSA 2048 M01		 2023-03-02 -
2023-09-08		 6 months crt.sh
in.applicationinsights.azure.com
Microsoft Azure TLS Issuing CA 06		 2023-05-03 -
2024-04-27		 a year crt.sh
*.doubleclick.net
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2023-05-22 -
2023-08-14		 3 months crt.sh
*.doubleverify.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-05 -
2023-07-07		 a year crt.sh
adentifi.com
Amazon RSA 2048 M02		 2023-02-22 -
2023-09-03		 6 months crt.sh
*.bfmio.com
Amazon RSA 2048 M02		 2023-03-17 -
2024-04-14		 a year crt.sh
*.deliveryengine.adswizz.com
Amazon RSA 2048 M02		 2023-02-09 -
2024-02-13		 a year crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2023-04-04 -
2023-09-27		 6 months crt.sh
*.tps.doubleverify.com
Go Daddy Secure Certificate Authority - G2		 2022-09-28 -
2023-10-30		 a year crt.sh
*.sojern.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-17 -
2024-02-17		 a year crt.sh
*.truste.com
Amazon RSA 2048 M02		 2023-02-28 -
2024-01-16		 a year crt.sh
*.azurewebsites.net
Microsoft Azure TLS Issuing CA 02		 2023-03-10 -
2024-03-04		 a year crt.sh
*.trustarc.com
Amazon RSA 2048 M02		 2023-04-17 -
2024-05-14		 a year crt.sh
i.clean.gg
GTS CA 1D4		 2023-05-24 -
2023-08-22		 3 months crt.sh
*.8proof.com
Sectigo RSA Domain Validation Secure Server CA		 2023-01-29 -
2024-02-07		 a year crt.sh
beacon.lynx.cognitivlabs.com
Amazon RSA 2048 M02		 2023-03-31 -
2024-04-28		 a year crt.sh
*.ctnsnet.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-01-04 -
2023-11-06		 10 months crt.sh
truffle.bid
R3		 2023-05-24 -
2023-08-22		 3 months crt.sh
*.iprom.net
R3		 2023-05-23 -
2023-08-21		 3 months crt.sh
*.crwdcntrl.net
Amazon RSA 2048 M01		 2022-11-07 -
2023-12-06		 a year crt.sh
*.tapad.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-14 -
2023-10-15		 a year crt.sh
rtactivate.com
Amazon RSA 2048 M01		 2023-03-14 -
2024-04-11		 a year crt.sh
*.tidaltv.com
Sectigo RSA Domain Validation Secure Server CA		 2023-06-08 -
2024-07-08		 a year crt.sh
*.richaudience.com
RapidSSL Global TLS RSA4096 SHA256 2022 CA1		 2023-02-27 -
2024-02-26		 a year crt.sh
*.targeting.unrulymedia.com
Sectigo RSA Domain Validation Secure Server CA		 2023-05-10 -
2024-05-10		 a year crt.sh
connectad.io
Cloudflare Inc ECC CA-3		 2023-03-16 -
2024-03-15		 a year crt.sh

This page contains 223 frames:

Primary Page: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Frame ID: C12EDFDEF8A31BFE17CDF46A3FEBA094
Requests: 331 HTTP requests in this frame

Frame: https://cmp.osano.com/
Frame ID: 96687C54CD3D3E03D286CFB9828458BE
Requests: 1 HTTP requests in this frame

Frame: https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Frame ID: FD3BD70957C4E54418B19D4C1412075E
Requests: 6 HTTP requests in this frame

Frame: https://cmp.osano.com/
Frame ID: DAEB0FF2C2C9EE61EDFA3223062792E5
Requests: 1 HTTP requests in this frame

Frame: https://cdn.jwplayer.com/libraries/FUtg69tL.js
Frame ID: D9616A3EACC644BE93E9FF94A4CD8602
Requests: 7 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Frame ID: BEBB0040EF3E9DADD8BDF6045393BB35
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Frame ID: 73C70B96B7CD6E57100DF5EA44F7803A
Requests: 3 HTTP requests in this frame

Frame: https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 38BB09EEE154D23D6F21AF7143D6173D
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=&us_privacy=1---
Frame ID: 96AAC16248A0FA46499DFD5C5A0AAA09
Requests: 2 HTTP requests in this frame

Frame: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Frame ID: 38A917B5864D57AC7F7432A75AC0386B
Requests: 15 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Frame ID: 184D645B9464C93ABA1854FB4FC82E31
Requests: 10 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4777538607685951564&gdpr=0&gdpr_consent=
Frame ID: F52AF37D2EF781192D18FE74B6C92A35
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAMwa38I1MJkQNkX-yEAAAAAAA&expiration=1687376680&is_secure=true&gdpr=0
Frame ID: 6CAC54DAFCF8A93369398F3959FABB30
Requests: 1 HTTP requests in this frame

Frame: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Frame ID: 7FDE9C0564D09E9CB6885610BA110241
Requests: 6 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Frame ID: 738D983AE4415401105996946142E794
Requests: 11 HTTP requests in this frame

Frame: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Frame ID: 98CC048CF96A82278F6B19DCD324A742
Requests: 7 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Frame ID: 957C39B30F1A6A763F2DF60659B2BE00
Requests: 11 HTTP requests in this frame

Frame: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Frame ID: 12F7FD9D4FDE22621DDC18EA27FC9113
Requests: 4 HTTP requests in this frame

Frame: https://crb.kargo.com/api/v1/dinitsync?partners=A9
Frame ID: 1CEBFAD4A96437AE1A57953A299F7949
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?id=3321274862842215126&ex=appnexus.com&gdpr=0
Frame ID: 7CC904520C3F420C0B82C3BC9359FDC4
Requests: 1 HTTP requests in this frame

Frame: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Frame ID: 331E5A4FB70358E998AF436FC384D43C
Requests: 7 HTTP requests in this frame

Frame: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Frame ID: FED4DF50F47A11B0F9FFCA98D44AE9BA
Requests: 13 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4361119996463975483505
Frame ID: 8FA6A6CAFE1A9878CDD4B5E41DE7087E
Requests: 1 HTTP requests in this frame

Frame: https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 389BFDFCB5B3289801D5EF822DAD60F2
Requests: 4 HTTP requests in this frame

Frame: https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 4CED2748EDCBCF9FCC2FABDCCB933DB5
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssG21yaiGJ9rDC7j8xIU73p9URQBH7qJZ_GFKwhXYxWZGJvmEBk_WVcziPbHxknM14KogxmgUjepnhOmJ2j19AYoDDJkZ1Ww86lwYU0ktBk0iwgWRgFadxPOS-MkVY0BNaa2ZEzCJxswh-S91ykcjZ_WaDwZPV7rhPOgW0CHw1fQchdVoEVBWMrrzikef3m0qCTHe58tRn6-YqPOQyDEusrXGSYGvM4zNOxbnvHqwcudfHayPr60-JnQ2qzg-oEvYyoYikjD_MhPOZm4Hp7F30gNl9dFeN4zw-JcR4mXJFFA1mVMeAFsdgxdIRXmlmuGbWThP5p5bU4j3SWJ1qEP8-2_BnRvIXuVh6nJQ44DT8OhtEi1cm81XD5YQZYYuox_h7dmMko&sai=AMfl-YT7_JBuL1ZzkjIZDoV-4Bzw1tBoN1QwaUrNHcJeMHjFq4t53vr2s9FvdkzDATNy_ZfpK5VOUBFX3BNV9LrMu2AkND9rVfkbfhWFBuOiuhdjaf7iJg8phz68MezRbw&sig=Cg0ArKJSzDU3haiCnBYCEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: B7E7CA92A7902043976669667860CEAE
Requests: 14 HTTP requests in this frame

Frame: https://imprnjmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8IVYCLAYki4IjLRbgOhJIFgVHWizAdSwAAABgYID-AIkZl7uJYTFzi2Y201q08YzcEodltBZ5DIORc-SyOGc2IyAx43I3MSxmbtHMZlqLNp6RW-KwjNYij2Ewco5cFufMZgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxZDD4iChiCv3HiIEZUUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABR20qOKYvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjc_iGm8XC4rKZJs7dxOPxbQa73cQ5GexmnsVse5zBJ5VTLaSk-oQIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYKJic0zM0yGa5VhNluLJhPbWjgZLdzKkWO1nM2GK5dvtRa9PqaLcWLcTWZbJBiwuBfJ0yKdCEeG4WplXI5si93M4XJOlouVceYYuWyj1WRlsU3EEs3JIp3ILvuOzeEbbhYLi8tmmjh3E4_HtxnsdhPnZLCbeRazfWNi88wMk-FaZZjN1qLJxLYWTkYLt3LkWC1ns-HK5VutRa-P6WKcGHeT2b4xG-4my8FkN9w3ZsPdZDmY7Ib7Dp3hu_qcjdLJUuzRqVbLyEtncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&cmcv=&pix=undefined&cb=1687290280813&uv=136905167&tms=1687290280813&abt=lotc_vD!nonrv_vA!t45!testmsn_vB!ufm_vE!ul136905-167_vA&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=f897b01f-4ff4-4c3d-ba24-dc00d9deb9ff&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Frame ID: D42D96B45672E28DA5A1BA72A2B0BA71
Requests: 1 HTTP requests in this frame

Frame: https://us-match.taboola.com/sync?dast=V8IVYCLAYki4IjLRbgOhJIFgVHWizAdSwAAABgYID-AIkZl7uJYTFzi2Y201q08YzcEodltBZ5DIORc-SyOGc2IyAx43I3MSxmbtHMZlqLNp6RW-KwjNYij2Ewco5cFufMZgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxZDD4iChiCv3HiIEZUUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABR20qOKYvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjc_iGm8XC4rKZJs7dxOPxbQa73cQ5GexmnsVse5zBJ5VTLaSk-oQIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYKJic0zM0yGa5VhNluLJhPbWjgZLdzKkWO1nM2GK5dvtRa9PqaLcWLcTWZbJBiwuBfJ0yKdCEeG4WplXI5si93M4XJOlouVceYYuWyj1WRlsU3EEs3JIp3ILvuOzeEbbhYLi8tmmjh3E4_HtxnsdhPnZLCbeRazfWNi88wMk-FaZZjN1qLJxLYWTkYLt3LkWC1ns-HK5VutRa-P6WKcGHeT2b4xG-4my8FkN9w3ZsPdZDmY7Ib7Dp3hu_qcjdLJUuzRqVbLyEtncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&excid=22&docw=0&cijs=1&nlb=false
Frame ID: BD919139CDA707068367AFD6BDD37065
Requests: 1 HTTP requests in this frame

Frame: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=
Frame ID: 96FAFA1DDF24279F3E4171AD41EADA31
Requests: 1 HTTP requests in this frame

Frame: https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Frame ID: 212B94F48EB7F7195CA9521EED035FA7
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Frame ID: 832DBB6DC6E0CE20161EF65EF3B33D1B
Requests: 11 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=ttd&i=db51a350-c421-4780-94b8-db6155d007ec
Frame ID: 225A842FB8814B25FAFB354572AED52A
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=mmh&i=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
Frame ID: 6EA43E4986CCE32190F7C45261D9A608
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=atm&i=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=&_test=ZJIBqAABSFKRcAAz
Frame ID: F30DC27227EC60EB0312E6FABD8FE98C
Requests: 1 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=
Frame ID: B6C9988C25A9B7BF6B54797B81AE06A4
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Frame ID: 3828CB084C20D3519387A5605DD58DB1
Requests: 3 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81MDVkYWRkYi1iOWYzLTRlZmYtYTdhNi0yNWM4NDJjMDUxMmQ=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv
Frame ID: 25E215D8E3D4D5AA9431CC3688437E98
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=sus&i=ZJIBqcCo5ukAAJLgBKoAAAAA
Frame ID: 8AB43345A5D34318B2DCD9190D8B4BAD
Requests: 1 HTTP requests in this frame

Frame: https://cs.admanmedia.com/sync/gumgum?puid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=&ccpa=
Frame ID: 4EACE397E5DD662F3343EF2D9116F397
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Frame ID: 0C21CD8D6A52069F3E6AB08FAC1C4A29
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=rth&i=RrG2QWcZ9j7dv54OJsuG&pi=gumgum&tc=1
Frame ID: CCAB041E250366D2852309AD48F02590
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?p=gumgum
Frame ID: 6EFE6081496CEC061CC2682BA24475BD
Requests: 3 HTTP requests in this frame

Frame: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Frame ID: E3FE175B329620C9BCD8EFFD314B07FC
Requests: 8 HTTP requests in this frame

Frame: https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBqcCo5ukAAJLgBLwAAAAA
Frame ID: 0C79F433F0F48E8DE4DC1CEA38DE4DF9
Requests: 22 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1922&pub_id=2234281
Frame ID: D0F0229DD3CCF4668D26EAECF17C191F
Requests: 2 HTTP requests in this frame

Frame: https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Frame ID: 13B8E5C6AD0773B7B181851275CCA6D7
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716634525412
Frame ID: 6353147D15B0CF71F0B4E656F1ADDBAF
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID479CC621-B2E0-490D-8915-42055EBBC0EB
Frame ID: FF6DF374099B4BAF9A7E284BE573BD8D
Requests: 1 HTTP requests in this frame

Frame: https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: FE12A904CB723B8E12AEF9B8FCDBA082
Requests: 4 HTTP requests in this frame

Frame: https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 5ED933D08CA70C7CEC6E1C9F45CCE6E5
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Frame ID: 9A8FE9B1B548F39D4150F3AFC32A51BC
Requests: 22 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=adcnnnssu&e=1918623590599
Frame ID: B4567744AB9109E063995E1C4C7BE2D8
Requests: 9 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=cbyfcuv&e=1918623590599
Frame ID: 7C4E42CF03BF9443AF4444779087D6D3
Requests: 16 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=bdaakmyj&e=1918623590599
Frame ID: 1974AD4540E80555EEFE102557320D66
Requests: 15 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=vciuxsaem&e=1918623590599
Frame ID: E61AA74FC85EDA80B857A57B365A13DC
Requests: 15 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=tnhfdisl&e=1918623590599
Frame ID: 9134564E92B2A2AF0DD95D3C72415558
Requests: 15 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=pexbbykyq&e=1918623590599
Frame ID: BA75EC76315877E03D55560547D52B60
Requests: 9 HTTP requests in this frame

Frame: https://sopalk.com/r/p.html?f=bkbch&e=1918623590599
Frame ID: 8B0CE8C9881C4DD591C3BF691FDE1601
Requests: 15 HTTP requests in this frame

Frame: https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 54C368113B71ACA19E00E2800C115B1A
Requests: 4 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: 88E1B01B6B8C3287FC5DF7E2111F666E
Requests: 16 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 8197E699114E762D1F2863D416F04D20
Requests: 2 HTTP requests in this frame

Frame: https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 6668C7CF100710E48387693CDCC4AA94
Requests: 4 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: C6CB2A048CB6224D6252093B992DFF40
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 2F141776B257DC6617769D337542F790
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 869DD85555639F121A80DE5F95810F08
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 881982413D0996EC339E55E42D76B0EF
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 2501972459F9395230202F49F7FED4CC
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 9FBA7815FFBA450BF45F1DF68559617F
Requests: 3 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3941.js
Frame ID: 069C6C0975ACCF697A79A396332E81B8
Requests: 3 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 74B2A439120DF707DB6B76C65D29C10F
Requests: 1 HTTP requests in this frame

Frame: https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=479CC621-B2E0-490D-8915-42055EBBC0EB&redir=true&gdpr=0&gdpr_consent=
Frame ID: 8D66A9609C12445B0A9A75F83D87965F
Requests: 1 HTTP requests in this frame

Frame: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Frame ID: 6C91FB69CA51683D31A2F54B7C23D09A
Requests: 1 HTTP requests in this frame

Frame: https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Frame ID: A131C87FFD075EB5707479652C75B4C8
Requests: 1 HTTP requests in this frame

Frame: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Frame ID: 8D20DA56D881F81BA4602B36A25B7FF9
Requests: 1 HTTP requests in this frame

Frame: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Frame ID: 796EA2B4F07253C7A60863F9FC3C4B8B
Requests: 1 HTTP requests in this frame

Frame: https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Frame ID: 75429882924C84F87A7857DD073BA7D2
Requests: 1 HTTP requests in this frame

Frame: https://usersync.gumgum.com/usersync?b=pbm&i=479CC621-B2E0-490D-8915-42055EBBC0EB
Frame ID: CBEC9E590EC047BA6B656DB80298D3C3
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: 582C255882B3E5ADDB4A1326164CE6A9
Requests: 28 HTTP requests in this frame

Frame: https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 81947A4F4001367CE6F89A89EB87CC0B
Requests: 4 HTTP requests in this frame

Frame: https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 7925409B8D47252E5D4E965E1EAF0A2E
Requests: 4 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: EA0F687137CD1345DC8C1E5123E6BC31
Requests: 2 HTTP requests in this frame

Frame: https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKbDfBMmwYAAAMA1gAFAQirg8ikBhD7ldmzqaO2lTwY1vWTicG84osuKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlC4vYxoWLmrlwFgAGimrrQBeND-BYABAYoBA1VTRJIBA0VVUpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEAigJodWYoJ2EnLCA0MjU0MjkwLCAwKTt1ZignaScBFAw2MDgyGRQ4ZycsIDExNjI0MDIyLCAwCSksYycsIDQwNjIwMDE3FRUscicsIDIxODMwODI4CUD0UwGSAr0EIXJtd01xZ2p4bjY4VEVMaTlqR2dZQUNDNXE1Y0JNQVE0QUVBQVNKRUlVTzdmd1ExWUFHQi1hQUJ3QUhnQWdBRUFpQUVBa0FFQm1BRUJvQUVRcUFFS3NBRUF1UUhGZ3NuY2E0c25QOEVCeFlMSjNHdUxKel9KQVFBQUFBQUFBTkFfMlFFQUFBQUFBQUR3UC1BQjFJZUVBdlVCY1g3YU9aZ0NBS0FDQWJVQ0FBQUFBTDBDQUFBQUFNQUNBTWdDQU5BQ0FOZ0NBT0FDQU9nQ0FQZ0NBSUFEQVpnREFhSURGd2l5a2NBc0VBWVlBUzFHVHlBME1nYzJORFl6TXpRem9nTVRDTUdQd0N3UUNoZ0JMUUFBZ0Q0eUEzVnVhN29EQ1U1WlRUSTZOakkzTU9BRDZVT0FCT21TNUFPSUJOQ1Q1QU9RQkFHWUJBSEJCQUFBQUFBAdYIQXlREeEgQUFBTmdFQVBFEeVgQUFBQ0lCZjR3cVFYVHBCUjBlMG50UDdFRgEaCQFAREJCUUFBUVBHRFdqMF95UVUFFxRLc2J0UDkyKAAAWgEoBQHwQ1BBXzRBVVM4QVhXdk1VRi1BWFMxSU1DZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUVlmaGV0UnVCNzFQNmdHQkxJR0pBa0FBBUkMQUFBQh2rBEJrARIJAQBDHRhETGdHQ2cuLpoCmQEhdHhRZDlRNkECXHVhdVhBU0FBS0FBeEg0WHJVYmdlOVQ4NjJRARBFRHBRMBFhDER3UDEdYQBGERgMQUFBRx0YAEcdGABIHRgQSGdBaVEREPBPRHdQdy4u2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20v8gIRCgZBRFZfSUQSBzQyNTQyOTDyAhIKBkNQR19JRBIIMTFpXhjyAgoKBUNQASg4ATDyAg0KCEFEVl9GUkVRERAcUkVNX1VTRVIFEAAMCSA0Q09ERRIA8gIzCghDUEcJD7gnTldVMVptTmhNell5TkdSbFpqTTBPRE01TURBd01EbGkuMWM4NDIz8gILCgdDUAk1HADyAhAKBUlPAYAEBzSJBgDyASEESU8VITgTCg9DVVNUT01fTU9ERUwBKxQA8gIaChYyFgAcTEVBRl9OQU0FmAgeCho2HQAIQVNUAT4QSUZJRUQBPhwNCghTUExJVAFN8LABMIADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjEwNDEjTllNMjo2Mjcw2gQCCAHgBAHwBLi9jGiIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAFDHgAANgFAeAFAfAF17ce-gUECAAQAJAGAJgGALgGAMEGCSQo8D_QBpgD2gYWChAJERkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAfQ_gXSBw0JETMBMQjaBwYBaHAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=1c3597042b578a865019f2f3f0ec0334f30d921f&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dvciuxsaem%26e%3D1918623590599,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dvciuxsaem%26e%3D1918623590599&
Frame ID: 32EDAAA9711CF9728AB5B84575A1F45E
Requests: 6 HTTP requests in this frame

Frame: https://acdn.adnxs-simple.com/strikeforce/script.js
Frame ID: ACD48B1465EE5C8BB67DE280B9CD76BD
Requests: 18 HTTP requests in this frame

Frame: https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Frame ID: 166852C1EAD0DEBE648F9C46491FC503
Requests: 1 HTTP requests in this frame

Frame: https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Frame ID: 6E275985A3849EECC00227D04107FF30
Requests: 8 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: F166DD2F482E08D7D9715B95F37608DE
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: D889F4DC80ED637039A5F4F77035D6A5
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 12CA3C085E776324FFD30B04365F1D43
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 129E48385E3D485F1EE9530641F91503
Requests: 2 HTTP requests in this frame

Frame: https://www.googletagservices.com/dcm/dcmads.js
Frame ID: D6BE022F834B4EC11548C2531EC09AF7
Requests: 16 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 0A5D6EE623F0EBF05CE940EBC6423574
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: B30BB8378B1F81404C9FE7029131F377
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 00B5AE78159E9FD17E0391F9FFF95BD8
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 3478FA5E63A99D62205F22911ACF1AE5
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 369257EC59BAAE3D9E4EAFA131224C6D
Requests: 10 HTTP requests in this frame

Frame: https://8proof.com/app/rtbmarkup/5111?id=515457626221&ctd=110096&crid=1178&ap=ZJIBrgAGQAAJiBH-AASP1zOnRTMZlV_S4Qn6Dw
Frame ID: 54575B8D80AD704810D981C0678C59EF
Requests: 3 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 7CAA6E8D61AB48D28875CF4F25FEF23B
Requests: 2 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e5c920de-0fa2-11ee-876c-8dbcb6804b27
Frame ID: C702F113F102BE6EBEC9C1E756E085A1
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Frame ID: A254B3F6806646397CAE01A30941ED1D
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
Frame ID: 0EF2CC76BAC52DACC76973358368B2D4
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:09wHc8i51QbHhu5&gdpr=0&gdpr_consent=
Frame ID: 84AF1E0ECE88E0C8E2E78AF5E4DCB571
Requests: 1 HTTP requests in this frame

Frame: https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=479CC621-B2E0-490D-8915-42055EBBC0EB
Frame ID: 2233BF734BBB524770F52E60A2D45F53
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501305684
Frame ID: 12D60230F55953BD142CF5DB0CB29073
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Frame ID: 9F9BC946E1C8EA96A7472C945800B4EE
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Frame ID: 566CCD84C109C5C0DD943DA7CE9CCF67
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Frame ID: CB3050E3BFCC8696C08EF23A5F1CBE44
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Frame ID: 7E3DBF71878D9A8BB6EAFAD87513B026
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=EBt_tnDEDsSGBBPtsQGSZA
Frame ID: 4CD892E95066C970C1EF20B080CF124F
Requests: 1 HTTP requests in this frame

Frame: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Frame ID: 7ED06340CD862DA7730B5336CDC43693
Requests: 1 HTTP requests in this frame

Frame: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=d93de280-8ab8-456d-b53b-9ab646fa4468
Frame ID: B152B8B3DE843E7AB7669F4960F2E339
Requests: 1 HTTP requests in this frame

Frame: https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID
Frame ID: FF6354E861354AA6DE2396425AAB7267
Requests: 1 HTTP requests in this frame

Frame: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Frame ID: 6D4CDBC83C483F79DD26867FEC50E133
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766881343085934
Frame ID: CC5E8E9D1FF28A3920806F143C01701F
Requests: 1 HTTP requests in this frame

Frame: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:8B59A33699C741AFA2C7A091E574C7C9&gdpr=0&gdpr_consent=
Frame ID: 6A2D0154F7AA5794429525599E33E5E8
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Frame ID: 814F626019739853A585C653672FB022
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 6BCE4D6EE6B0FAE48FE69B13B42E9A33
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 83D8BA753CA619A00106D78C91116C29
Requests: 2 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 4F58923890838316D74FDB9C78D1542C
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: AFD3423994DF43DED010368528D019C2
Requests: 2 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3941.js
Frame ID: 8B22AF28F30B920058612E79B772D4D7
Requests: 3 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 137B2023D552F1A47510514491567CC9
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: A04BA0F8A99EB0485011BD6A60B26BFC
Requests: 3 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: CF8B63F5DE316FE6D9763B966E08B648
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: F94E7DC79692077C20995B8C52006C03
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 1D7F702AE16568B1C588C0A1514EF623
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 96DA0928059FAC754053DC1655A241D6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
Frame ID: 7E150938EFB7AF34C88CFE610648B4F9
Requests: 1 HTTP requests in this frame

Frame: https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F286%2F916%2F1%2F9.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
Frame ID: 5BD919B2A6A105B1DF964B35FE6DAA5D
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Frame ID: DF46A4AB3477199A306E544A8839D08E
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Frame ID: 89C50484069A03D2988A1E3A102921B8
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: 38BD8E893E9C192CC94DFA17618B2C0A
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Frame ID: FE118006DD1C3BCB0A47A21A70933CDB
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/5d62234a37f0646bf2303b81bf9e9a9f?gdpr_consent=&gdpr=0
Frame ID: 8FDD09E9FE9C0951D33C6EAC973C4E3A
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 5207DE2D7C09C57ADA55BF5838D47620
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 6FB2664E0728046F49250807559DE03B
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 0E70CD25E077DEE323BEB1B46980BD13
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: FB29BCE9C005883104DF45509D97CAD5
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: C1AB102AFB694F02BE8F678FD29B23AA
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: 0BAF9FEF099A188A9CFB042D19E3C9C2
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 789A56150133D04CA06FBE155B92739A
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: 5F1A02CB041F103478BD8D6A0390E41A
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: E241D8A0D085B427937E4A075CA6BC0A
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: CA2EC1CBC65BACF7024ED983E9AAC981
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Frame ID: B9C88C93E61AF80D92AAC58221C8AC5D
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements3941.js
Frame ID: 3D75BF3AEAECD30D8487500BC8DC9A24
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 7EB893590A13F3450479E35840789B5D
Requests: 3 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: A68F103FC279BEFCD0467ECA59F3CDD4
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
Frame ID: 77B46BC8E07DB4CE8CBFF5AF413F9744
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: B385BC2B4A3ED5ADF70DCDBB21CFA488
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=&us_ps=
Frame ID: 2B38C936F0A910932B82157D20C1D534
Requests: 1 HTTP requests in this frame

Frame: https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Frame ID: AA58246BE01F2502E931F39B6DB663B7
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
Frame ID: 29C8909DB095E1B206E46F5246A0C2BC
Requests: 1 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 83308B73369EA8A483FF27CC8064ACF0
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Frame ID: 2F56B20237944FFDA861E0AEA7EBB420
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4777538607685951564
Frame ID: 9809930DC7045B1476F6577A782B8B9E
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: F63ECE83AFBB28E0F5CF62B28B5A32A9
Requests: 1 HTTP requests in this frame

Frame: https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Frame ID: 073A09A43D5D21D752ACD2DFDAB3AA8E
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Frame ID: 6D40E0B8383CC00B3A3DD441741DE077
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 963838A3DEF54A599160FB21A7BB3784
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 1CEEF0E014388BA80ABF486E5AEB6884
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Frame ID: 91AE8CB3FAC149BAD9A04FB8505950C0
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/f39057767042789454688717f4d2f3ca?gdpr_consent=&gdpr=0
Frame ID: E0DE72ACC6AF5C946C777D3FF842F62E
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: 7F271063DEE10D7121BDBDC482186B71
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
Frame ID: BE351C2077D2824416FDA39330DAA41E
Requests: 1 HTTP requests in this frame

Frame: https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
Frame ID: 3E069E8466343A3713092FF8E238C58D
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: AA70F1C51DF282A2AA23475872EA263D
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/?us_privacy=1---
Frame ID: A7101767DB25F2321E58F7EA6B4A5DB2
Requests: 2 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 5C4AF0557D359265F6191BDAC532D8A5
Requests: 2 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Frame ID: 35A9FDE552FB2F46CC6B1605B4088729
Requests: 6 HTTP requests in this frame

Frame: https://choices.trustarc.com/get?name=admarker-icon-tr.png
Frame ID: 7B284AF92B89D4A75C4208C9EB0BCA1F
Requests: 2 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 0F653AA05705F4318CD70F801F955BC4
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Frame ID: C01EC5E8920426D1009364C0C6976AAA
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Frame ID: 81E431378C5D88839BFF1D31DD95FDB6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Frame ID: 826B4A44341635CBB80224AA90BE720C
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: B56AA1BA938C89AC00993DEC90B79F9F
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/922b9b5de53a83057b6ee4965f3d361?gdpr_consent=&gdpr=0
Frame ID: 04497CA0C55172AF2CB0446451E00163
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Frame ID: D0B8A043648AB55747776538F97C9329
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Frame ID: 402466D04AC556EA878994C79A7D9E81
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Frame ID: 1177A47E8D302229AD83025F1BDDED55
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 2CDDFAF04940D2B0E68F8C8D23CB1BCB
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: 7DDCB9C14DC146BD04FC34BB122DBD25
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: E86D97C59FBC2A87B4A28297DB8C16CC
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: 4C2022453C021D71FDD89FB1D2E4C67F
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Frame ID: 11F8B2F355CDDEF438A7BB42D2AF8227
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Frame ID: 83D91CF443E1DCE5A3F87A9868F16B4A
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Frame ID: F079B77C6D7A03977D15B8B1D093FC75
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/c73f079468a9778d6dba7d2f5443dc3?gdpr_consent=&gdpr=0
Frame ID: 823C7A7D5215704BB33FD14E9958DBE0
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/freewheel/f76549c7243c44b1d97f895bf5069c2?gdpr_consent=&gdpr=0
Frame ID: 6AC02F5F36B7DE43A86BC902738813C0
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 0FA87BACA5ED42854F8C0CC79BF84029
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 4720F9FDDE60CC33DBEA61437970FFA5
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: BB841ADA9E3A09271568577D64DEAB98
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: EF14548C9A9FCC2BD63616A9CEC7A3A3
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Frame ID: FABE6DC200B11CCA99637B82E70FFB49
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Frame ID: 53D23D5B42F4CDE655D022569D384022
Requests: 1 HTTP requests in this frame

Frame: https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
Frame ID: 694015F45BA9A8CF990F83A2C0639852
Requests: 1 HTTP requests in this frame

Frame: https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
Frame ID: 68501F099C1AD954A9407A047F3F12BC
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/drop_cookie_sw.php
Frame ID: 43791C9FD50383D219C137BAD0BF41B3
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/richaudience/8e94c585-96a4-4941-b2e1-1zz1687290289
Frame ID: 4CE303C2B2D3EEA98B3F66B8A800669E
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Frame ID: A5F47FCA36CEFAA69F827EDBCEC06F45
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Frame ID: C1F3CEB15B7066FB278646ED4B74CD6A
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Frame ID: 7C3ABE1F955EEE291BB23DBEC5E2B4D6
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Frame ID: 179227153D4F10A41AC109E79B36D062
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Frame ID: 347566149011DBB0611EC2913D81628F
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Frame ID: 0EE1EE2C7AC00DCECEBDEFAA83DD30E2
Requests: 1 HTTP requests in this frame

Frame: https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
Frame ID: 92EA12E65A395359D4D6503ABC80D943
Requests: 1 HTTP requests in this frame

Frame: https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Frame ID: C9AA1D5A00EFB21E52B947B18FF5E1C2
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/smart/4777538607685951564
Frame ID: 958BD180D02E3744C30C731A588EBB53
Requests: 1 HTTP requests in this frame

Frame: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Frame ID: B362D888B0C7BA008C3DA1A4DF057C68
Requests: 1 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=RrG2QWcZ9j7dv54OJsuG&pi=connectad
Frame ID: 81CBE07938350E7636D457C706634C39
Requests: 1 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgbPZHuyVpOjRtQ-i3ojE3
Frame ID: 25C565FA31E0D65A599550F41778CC6F
Requests: 1 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1235390588561432912
Frame ID: 4AA5553380236EB58C4BF3C0A33727A9
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Frame ID: 4A3B4BCF63DFDFF52B28BA4A4103AA41
Requests: 1 HTTP requests in this frame

Frame: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Frame ID: 2DD18C9F7415BD308618E0C111F0CAC0
Requests: 10 HTTP requests in this frame

Frame: https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Frame ID: 12BBE718FF1D9A1890A08B497D23E758
Requests: 1 HTTP requests in this frame

Frame: https://csync.smilewanted.com/set_partner_userid_get/connectad/WO8dHzCc5VwX4NQ47Y5w94la1DNoDjurpcn5rgPp
Frame ID: 32AD41DAABA9AA853223F765FA22BDE1
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Frame ID: DF3FA727CF9FA77D78364C8A3719F2B6
Requests: 8 HTTP requests in this frame

Frame: https://sync.connectad.io/umatch/1?dataid=data1&uuid=479CC621-B2E0-490D-8915-42055EBBC0EB
Frame ID: F11BEAF61DB05E97309EAEBDEB103D54
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 63E85002E28B03E29A433B415034BB92
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: BD9E72F8F6683AE2B358061485E8EF07
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: CE588AD23FABB40AEB6B77DE4455A882
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 86931ADC4521120B6703357C2AE3C89F
Requests: 2 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Frame ID: 6D718BD5E9FDDA75315CD7516788BFE8
Requests: 2 HTTP requests in this frame

Frame: https://us-match.taboola.com/sync?dast=V8IVYCLAYki4IjLRbgOhJIFgVHWizAdSwAAABgYID-AIkZl7uJYTFzi2Y201q08YzcEodltBZ5DIORc-SyOGc2IyAx43I3MSxmbtHMZlqLNp6RW-KwjNYij2Ewco5cFufMZgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxZDD4iChiCv3HiIEZUUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABR20qOKYvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjc_iGm8XC4rKZJs7dxOPxbQa73cQ5GexmnsVse5zBJ5VTLaSk-oQIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYKJic0zM0yGa5VhNluLJhPbWjgZLdzKkWO1nM2GK5dvtRa9PqaLcWLcTWZbJBiwuBfJ0yKdCEeG4WplXI5si93M4XJOlouVceYYuWyj1WRlsU3EEs3JIp3ILvuOzeEbbhYLi8tmmjh3E4_HtxnsdhPnZLCbeRazfWNi88wMk-FaZZjN1qLJxLYWTkYLt3LkWC1ns-HK5VutRa-P6WKcGHeT2b4xG-4my8FkN9w3ZsPdZDmY7Ib7Dp3hu_qcjdLJUuzRqVbLyEtncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&excid=22&docw=0&cijs=1&nlb=false
Frame ID: 3D12699586D1CC3633F1D2E1A592E11A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Meghan Markle earned more than The Weeknd for '12 hours work': Spotify

Page URL History Show full URLs

  1. http://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-... HTTP 301
    https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • //maps\.google(?:apis)?\.com/maps/api/js
Overall confidence: 100%
Detected patterns
  • accounts\.google\.com/gsi/client
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • (?:prototype|protoaculous)(?:-([\d.]*[\d]))?.*\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • tpc\.googlesyndication\.com/safeframe
Overall confidence: 100%
Detected patterns
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • [^a-z]mtc.*\.js
Overall confidence: 100%
Detected patterns
  • moatads\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • /polyfill\.min\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.com/[^"]*(?:prebid|/pb\.js)
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • \.quantserve\.com/quant\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • //s\.btstatic\.com/tag\.js
Overall confidence: 100%
Detected patterns
  • <iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
  • \.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

999
Requests

79 %
HTTPS

24 %
IPv6

173
Domains

289
Subdomains

177
IPs

12
Countries

14884 kB
Transfer

33994 kB
Size

330
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ HTTP 301
    https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46
  • https://unpkg.com/web-vitals@3/dist/web-vitals.iife.js HTTP 302
  • https://unpkg.com/web-vitals@3.3.2/dist/web-vitals.iife.js
Request Chain 89
  • https://pixel.sitescout.com/dmp/asyncPixelSync HTTP 302
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Request Chain 93
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1687290277738&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1687290277738&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
Request Chain 94
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de HTTP 302
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
Request Chain 128
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1627 HTTP 301
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Request Chain 129
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=
Request Chain 130
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341 HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341
Request Chain 131
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=&xl8blockcheck=1 HTTP 302
  • https://load77.exelator.com/pixel.gif
Request Chain 133
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=&ct=y
Request Chain 169
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift HTTP 302
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Request Chain 192
  • https://rp.liadm.com/j?dtstmp=1687290279473&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4 HTTP 302
  • https://rp4.liadm.com/j?dtstmp=1687290279473&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjY%3D&n3pc=true
Request Chain 242
  • https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302918801455535000V10
Request Chain 243
  • https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=4bdf9286
Request Chain 253
  • https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Request Chain 254
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4777538607685951564&gdpr=0&gdpr_consent=
Request Chain 255
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0 HTTP 302
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=5048ab6c3736145f&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAMwa38I1MJkQNkX-yEAAAAAAA&expiration=1687376680&is_secure=true&gdpr=0
Request Chain 264
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint HTTP 302
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Request Chain 266
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=3321274862842215126&ex=appnexus.com&gdpr=0
Request Chain 267
  • https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 HTTP 301
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0 HTTP 302
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Request Chain 269
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0 HTTP 302
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4361119996463975483505
Request Chain 283
  • https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID HTTP 302
  • https://usersync.gumgum.com/usersync?b=apn&i=3321274862842215126
Request Chain 284
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://beacon.lynx.cognitivlabs.com/bidSwitch.gif?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=425&user_group=1&expires=365&user_id=cde16cd9-d9ed-4cdd-9d7f-cd6930766499&ssp=gumgum2&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://usersync.gumgum.com/usersync?b=bsw&i=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=&us_privacy=
Request Chain 285
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=sta&i=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187
Request Chain 286
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__ HTTP 302
  • https://stags.bluekai.com/site/23178?id=oRzH9Zt83axgglTEQFsr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT232SPJEDSWTUHAZWC6DHM5WFIRKRIZZXE&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT232SPJEDSWTUHAZWC6DHM5WFIRKRIZZXE HTTP 302
  • https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=oRzH9Zt83axgglTEQFsr
Request Chain 287
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25 HTTP 302
  • https://usersync.gumgum.com/usersync?b=pln&i=37Wunos71Ooo&ev=1&pid=558355
Request Chain 288
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D HTTP 302
  • https://usersync.gumgum.com/usersync?b=obn&i=ENC%28s6yE2BucfO1q6O5cGt5K4cTe7u41Sh94D-uVc8gCn8EN9Pp9URU7hcInpJLkxXge%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26platformUid%3D%7Bplatform_uid%7D%26obuid%3DENC%28s6yE2BucfO1q6O5cGt5K4cTe7u41Sh94D-uVc8gCn8EN9Pp9URU7hcInpJLkxXge%29%26gdpr%3D0 HTTP 302
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&obuid=ENC(s6yE2BucfO1q6O5cGt5K4cTe7u41Sh94D-uVc8gCn8EN9Pp9URU7hcInpJLkxXge)&gdpr=0 HTTP 302
  • https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0 HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3Ds6yE2BucfO1q6O5cGt5K4cTe7u41Sh94D-uVc8gCn8EN9Pp9URU7hcInpJLkxXge%26gdpr%3D0%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%0A%26initiator%3Dplatform
Request Chain 289
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D HTTP 302
  • https://usersync.gumgum.com/usersync?b=opx&i=d339c87a-f163-4196-980f-0839cae2f497
Request Chain 290
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=oth&i=y-Xsg5mxlE2pe96.x9qyFU02OVX2aZ_4PIR_Sm~A
Request Chain 291
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dvnt%26i%3D HTTP 302
  • https://usersync.gumgum.com/usersync?b=vnt&i=dc345a35-a603-4ec3-b75a-7bd7631cedf4
Request Chain 292
  • https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D HTTP 307
  • https://usersync.gumgum.com/usersync?b=snc&i=16F85AA78ED646369CC5112051089037
Request Chain 294
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D HTTP 302
  • https://usersync.gumgum.com/usersync?b=idi&i=92e9d51d-f58b-4a55-97b2-6ee67deb9268
Request Chain 295
  • https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=sad&i=4777538607685951564
Request Chain 298
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJIBqD7bZiR98t4YH35qSwAADZ0AAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid= HTTP 302
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEGNTMINOlncDrepDG2fIvx0&google_cver=1
Request Chain 299
  • https://match.adsrvr.org/track/cmf/casale HTTP 302
  • https://match.adsrvr.org/track/cmb/casale HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=db51a350-c421-4780-94b8-db6155d007ec&expiration=1689882280&gdpr=0&gdpr_consent=
Request Chain 301
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJIBqD7bZiR98t4YH35qSwAA HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHFE4sN5kzw-2axyRnpj3t0&google_cver=1
Request Chain 302
  • https://sync.srv.stackadapt.com/sync?nid=68 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=ruPoSpZIUIJ7GLwbam2kAZU4mbs
Request Chain 303
  • https://cm.adgrx.com/bridge?AG_PID=casale&AG_SETCOOKIE HTTP 302
  • https://cm.adgrx.com/bridge.gif?AG_PID=casale HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=e5c920de-0fa2-11ee-876c-8dbcb6804b27
Request Chain 304
  • https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=8B59A33699C741AFA2C7A091E574C7C9
Request Chain 307
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=mercurynews.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=JPcN63xja3RPUzI4UW9vbkcydjhzZmpmRWZ1RmxpY1dTK09yMVZiaWNQTzh0dVZVNElZWmJGNFdxWWVSOUg0VEIwQ2FLTXllQUVTWU0vazduM3VRQlN5U0dGMDJnbDdHTW03bFI3Umk3ckNOODJYTlYxczZkd3JpcWtGWkYvKzBqdXpIOXVmWmsyeG5xWVZWZGJPRXB5RUVBTU5hcmtRb2ZKWVlPWHc3UFZRVEMvajd3WUNpYWdqa0Vob2lUT1RRNnp0c2QxOExEb1Zoc3VGNk5mcXRXS3BaU25tdENnbEphTlZBMnZQbnhDMFJPeTUwUmJMN2dVZi9NSUp5d0xLeXJabHViSW1CU0RQZDdxZDJDb2E0NW9jdlpQdz09fA&cppv=2
Request Chain 312
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
Request Chain 313
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2 HTTP 302
  • https://ssum.casalemedia.com/usermatchredir?s=186046&cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DGM7HYz3VFjuymbiqnJLyjuPy%26source_user_id%3D__UID__ HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=ZJIBqD7bZiR98t4YH35qSwAA%263485
Request Chain 314
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3 HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
Request Chain 315
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4 HTTP 302
  • https://sync.srv.stackadapt.com/sync?nid=15 HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187&gdpr=&gdpr_consent=
Request Chain 317
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=ODBGRjI3UktjS2ZHNUF5NjJidjFqQQ&gdpr=0&gdpr_consent= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDCqW60D2mGdp7ne38rlgqo&google_cver=1
Request Chain 318
  • https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid= HTTP 302
  • https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=7be1ef66bce234f&is_secure=true&networkId=14200&version=1&nuid= HTTP 302
  • https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMwa38I1MJswMnwj_kAAAAAAA&expiration=1687376680&nuid=&is_secure=true
Request Chain 320
  • https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.yellowblue.io/cs?aid=11601&id=cd6f6ccf771b1516e146ebb42d12c42&gdpr_consent=&gdpr=0
Request Chain 321
  • https://us-u.openx.net/w/1.0/cm?id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D HTTP 302
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=cc04709c-0e99-4485-b433-4446231b2192
Request Chain 322
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Request Chain 323
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11596%26id%3D$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=3321274862842215126&gdpr=0&gdpr_consent=
Request Chain 325
  • https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D115667%26uid%3D%5BUID%5D HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=2c0f44d2-6a66-40d3-a3dc-600d11c96224
Request Chain 326
  • https://csync.loopme.me/?pubid=11362&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11571%26id%3D%7Bdevice_id%7D HTTP 307
  • https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr_consent=null&gdpr=0
Request Chain 327
  • https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.yellowblue.io/cs?aid=11591&id=y-RIWzuEFE2uKow5_PIsLk26F1cS2t77MI~A&gdpr_in_effect=0
Request Chain 328
  • https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent= HTTP 302
  • https://cs.yellowblue.io/cs?aid=11587&uid=45bb695b-34f1-45bc-b104-fd1bfa86c044&gdpr=0
Request Chain 329
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OUU4QjIxMEItMjlGMC00NzMzLUJERjctMTM0NEQ2OEMzMzc2&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Request Chain 330
  • https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X HTTP 302
  • https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212190061798909
Request Chain 333
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=yieldmo HTTP 302
  • https://ads.yieldmo.com/sync?pn_id=rc&id=LJ4P2F0B-P-LXKJ
Request Chain 334
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&redir%3Dhttps%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3D%5BRX_UUID%5D HTTP 302
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&zcc=1&cb=1687290281073 HTTP 302
  • https://ad.turn.com/r/cs?pid=45&rndcb=2342778772 HTTP 302
  • https://sync.1rx.io/usersync/turn/8787793056595731277?dspret=1&gdpr=&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3DRX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005 HTTP 302
  • https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 335
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3107&partner_device_id=g64ff5b6b6307102e7fd HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=6e633baa-8f35-487f-a052-7b9fb224da66%252C%252C&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=db51a350-c421-4780-94b8-db6155d007ec&ttd_puid=6e633baa-8f35-487f-a052-7b9fb224da66%2C%2C
Request Chain 336
  • https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an HTTP 302
  • https://ads.yieldmo.com/v000/sync?userid=3321274862842215126&pn_id=an
Request Chain 337
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.yieldmo.com%252Fsync%253Fpn_id%253Dpub%2526id%253D%2523PMUID%2526gdpr%253DPM_GDPR%2526gdpr_consent%253DPM_CONSENT HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.yieldmo.com%252Fsync%253Fpn_id%253Dpub%2526id%253D%2523PMUID%2526gdpr%253DPM_GDPR%2526gdpr_consent%253DPM_CONSENT&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDc5Q0M2MjEtQjJFMC00OTBELTg5MTUtNDIwNTVFQkJDMEVC&gdpr=-1&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
Request Chain 344
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://usersync.gumgum.com/usersync?b=ttd&i=db51a350-c421-4780-94b8-db6155d007ec
Request Chain 345
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d HTTP 302
  • https://usersync.gumgum.com/usersync?b=mmh&i=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
Request Chain 346
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=ZJIBqAABSFKRcAAz HTTP 302
  • https://usersync.gumgum.com/usersync?b=atm&i=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=&_test=ZJIBqAABSFKRcAAz
Request Chain 348
  • https://cms.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=m9yu7p3Z9uqAiafqmt666Z_Zp-2AiaLlmtzxSaVw
Request Chain 349
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=87&3pid=45f36b13-857c-4e12-af33-6a514e9bfc45
Request Chain 351
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=83&3pid=LJ4P2F0B-P-LXKJ&gdpr=0
Request Chain 352
  • https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=49&3pid=37Wunos71Ooo&ev=1&pid=558511&gdpr_consent=&gdpr=0
Request Chain 355
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Request Chain 364
  • https://tg.socdm.com/aux/idsync?proto=gumgum HTTP 302
  • https://usersync.gumgum.com/usersync?b=sus&i=ZJIBqcCo5ukAAJLgBKoAAAAA
Request Chain 367
  • https://creativecdn.com/cm-notify?pi=gumgum HTTP 302
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1 HTTP 302
  • https://usersync.gumgum.com/usersync?b=rth&i=RrG2QWcZ9j7dv54OJsuG&pi=gumgum&tc=1
Request Chain 368
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum HTTP 301
  • https://eus.rubiconproject.com/usync.html?p=gumgum
Request Chain 384
  • https://tg.socdm.com/aux/idsync?proto=taboola HTTP 302
  • https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBqcCo5ukAAJLgBLwAAAAA
Request Chain 385
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__ HTTP 302
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__&nut&uu=6fadbf2f9c8147e5bed870a0b19b7fb3 HTTP 302
  • https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=6fadbf2f9c8147e5bed870a0b19b7fb3
Request Chain 387
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698 HTTP 302
  • https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4P2F0B-P-LXKJ
Request Chain 388
  • https://pr-bh.ybp.yahoo.com/sync/taboola/1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726?gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ft3eHrRE2oThAXdKHDLJBA.ObW.vE1pYFz.WDA--~A
Request Chain 389
  • https://trace.mediago.io/ju/cs/taboola HTTP 302
  • https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=883b8c2c02f36ac778b5c1a5e5678e71
Request Chain 390
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc HTTP 302
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEDt8YPLwaBPduBVy5g3Vg4Y&google_cver=1
Request Chain 391
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726:$UID HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160648&pmc=1&pr=https%3A%2F%2Fsync-pm.ads.yieldmo.com%2Fsync%3Fpn_id%3Dpub%26id%3D479CC621-B2E0-490D-8915-42055EBBC0EB%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Request Chain 392
  • https://sync.taboola.com/sg/google-network/1/rtb/?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
Request Chain 393
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=db51a350-c421-4780-94b8-db6155d007ec
Request Chain 397
  • https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=fbc3b4d9-a11b-4371-a88d-35e24043ca77
Request Chain 398
  • https://id5-sync.com/s/464/9.gif?puid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%7BID5UID%7D HTTP 302
  • https://id5-sync.com/c/464/464/7/1.gif?puid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&gdpr=0&gdpr_consent=&us_privacy= HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F3%2F6%2F2.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/3/6/2.gif?puid=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F108%2F5%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/108/5/3.gif?puid=6e633baa-8f35-487f-a052-7b9fb224da66&gdpr=0&gdpr_consent= HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F429%2F4%2F4.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
  • https://id5-sync.com/c/464/429/4/4.gif?puid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/264.gif?puid=db51a350-c421-4780-94b8-db6155d007ec&ttl=%%TTL%% HTTP 302
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/464/2/2/6.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/2/2/6.gif?puid=3321274862842215126&gdpr=0&gdpr_consent= HTTP 302
  • https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F1%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F1%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/464/112/1/7.gif?puid=885894C13F35428C&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F0%2F8.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/441/0/8.gif?puid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A
Request Chain 399
  • https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&gdpr=0&consent=&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dtaboola%26bsw_param%3D2491035f-3b91-450a-bf47-d3da43a3fb7b%26gdpr%3D0%26consent%3D%26gdpr_pd%3D%26expires%3D7 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=3e3e5b7a69bb4c839bc23ca0143ab614&ssp=taboola&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&consent=&gdpr_pd=&expires=7 HTTP 302
  • https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Request Chain 400
  • https://rtb.mfadsrvr.com/sync?ssp=taboola HTTP 302
  • https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=45f36b13-857c-4e12-af33-6a514e9bfc45 HTTP 302
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=45f36b13-857c-4e12-af33-6a514e9bfc45&tbid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&query=taboola_hm%3D45f36b13-857c-4e12-af33-6a514e9bfc45&isDirect=0
Request Chain 403
  • https://sync.srv.stackadapt.com/sync?nid=140 HTTP 302
  • https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=ruPoSpZIUIJ7GLwbam2kAZU4mbs
Request Chain 405
  • https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&ph=295bf259-a378-4089-aae8-a2a995ba8627&id=37f45540-fa88-4005-bf73-8a7ac39467e3&r=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fopenxrtb-network%2F1%2Frtb-h%2F%3Fgdpr%3D0%26us_privacy%3D1---%26orig%3Dvideo%26taboola_hm%3D HTTP 302
  • https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=a33e8f29-3377-4897-8dda-1952a3cf5165
Request Chain 415
  • https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=2889108176641716303&us_privacy=1--- HTTP 303
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-9-UvyEmtihn86JfTZG0fWnuLfwac5-se2Drtlg&us_privacy=1--- HTTP 303
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-9-UvyEmtihn86JfTZG0fWnuLfwac5-se2Drtlg&us_privacy=1---&us_privacy=1---
Request Chain 416
  • https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=7130a7b6-bb6a-4db6-8b12-3801a087cf17&us_privacy=1--- HTTP 302
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=5a991fdb-988c-4f1f-9a42-ecad99d56781%3A1687290282.0281818&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D5a991fdb-988c-4f1f-9a42-ecad99d56781%253A1687290282.0281818%26_%3D1687290282.0328426&cb=1687290282.032894 HTTP 302
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=968625788422591216&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D5a991fdb-988c-4f1f-9a42-ecad99d56781%253A1687290282.0281818%26_%3D1687290282.0328426 HTTP 302
  • https://idsync.rlcdn.com/501709.gif?partner_uid=5a991fdb-988c-4f1f-9a42-ecad99d56781%3A1687290282.0281818&_=1687290282.0328426 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CM3PHhJBCj0IARAFGjc1YTk5MWZkYi05ODhjLTRmMWYtOWE0Mi1lY2FkOTlkNTY3ODE6MTY4NzI5MDI4Mi4wMjgxODE4EAAaDQiqg8ikBhIFCOgHEABCAEoA HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESED9wGh0U6jrfnkp2GSxdIF4&google_cver=1
Request Chain 417
  • https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=7130a7b6-bb6a-4db6-8b12-3801a087cf17&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 303
  • https://x.bidswitch.net/sync?ssp=liveintent&user_id=7130a7b6-bb6a-4db6-8b12-3801a087cf17 HTTP 302
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=liveintent HTTP 302
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=liveintent HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=1235390588561432912&ssp=liveintent HTTP 302
  • https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Request Chain 418
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1--- HTTP 302
  • https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db51a350-c421-4780-94b8-db6155d007ec HTTP 303
  • https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db51a350-c421-4780-94b8-db6155d007ec
Request Chain 420
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=7130a7b6-bb6a-4db6-8b12-3801a087cf17&us_privacy=1--- HTTP 302
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=7130a7b6-bb6a-4db6-8b12-3801a087cf17&us_privacy=1---&rd=Y
Request Chain 423
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&khaos=LJ4P2F0B-P-LXKJ HTTP 302
  • https://s.amazon-adsystem.com/ecm3?id=LJ4P2F0B-P-LXKJ&ex=d-rubiconproject.com&status=ok&gdpr=0
Request Chain 435
  • https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716634525412
Request Chain 437
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=R5zGIbLgSQ2JFUIFXrvA6w%3D%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Request Chain 438
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=479CC621-B2E0-490D-8915-42055EBBC0EB HTTP 302
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D6e633baa-8f35-487f-a052-7b9fb224da66%252C%252C HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=3321274862842215126&pt=6e633baa-8f35-487f-a052-7b9fb224da66%2C%2C
Request Chain 440
  • https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent= HTTP 302
  • https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=479CC621-B2E0-490D-8915-42055EBBC0EB&vxii_pid=12&vxii_pid1=10067&vxii_rcid=69245832-6661-449e-82cd-f2fb859b73e0
Request Chain 441
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBwVNXZ9auhyOaTXcxEN6nE&google_cver=1
Request Chain 442
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:8B59A33699C741AFA2C7A091E574C7C9
Request Chain 443
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2889108176641716303&gdpr=0&gdpr_consent=&us_privacy=
Request Chain 444
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
Request Chain 445
  • https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&gdpr_consent=undefined&gdpr=0&us_privacy=1---&khaos=LJ4P2F0B-P-LXKJ HTTP 302
  • https://usersync.gumgum.com/usersync?b=mag&i=LJ4P2F0B-P-LXKJ&gdpr=0&gdpr_consent=undefined&us_privacy=1---
Request Chain 446
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr_consent=undefined&gdpr=0&us_privacy=1---&khaos=LJ4P2F0B-P-LXKJ HTTP 302
  • https://cs.yellowblue.io/cs?aid=11590&id=LJ4P2F0B-P-LXKJ&gdpr=0&gdpr_consent=undefined&us_privacy=1---
Request Chain 447
  • https://token.rubiconproject.com/token?pid=36584&gdpr=0 HTTP 302
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ4P2F0B-P-LXKJ&gdpr=0
Request Chain 448
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTE4YTg0M2IwNmJiZGE1MDQ2ODJiMTczMzc3ZWM1OGMyZWFhMDcwMQ&gdpr=0
Request Chain 449
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&expires=30
Request Chain 451
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=0ffS7W8KTNOV5T0EkHrr_g&rk=usync-na&gdpr=0 HTTP 302
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=0ffS7W8KTNOV5T0EkHrr_g&gdpr=0
Request Chain 452
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEDFeaR4jdIiG4Hbl8Cz4Cqs&google_cver=1
Request Chain 453
  • https://token.rubiconproject.com/token?pid=25470&gdpr=0 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo0UDJGMEItUC1MWEtK&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESEMPX5we3jfJ1ADyBRwg_6f0&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UDJGMEItUC1MWEtK&google_push=&gdpr=0
Request Chain 454
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0 HTTP 302
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/GFp5IK8Wtlfl9KdDoUK7cQ?csrc=&gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-4zu9LXtE2oJE7rMGoTe_XlqwGXg0BtsZgKmn0A--~A
Request Chain 481
  • https://image8.pubmatic.com/AdServer/ImgSync?p=162935&us_privacy=1--- HTTP 302
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=479CC621-B2E0-490D-8915-42055EBBC0EB&redir=true&gdpr=-1&gdpr_consent= HTTP 302
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-36LK.RJE2uULfI0lRI4Z5o8v1zE.4FE-~A
Request Chain 482
  • https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=image HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c HTTP 302
  • https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESECsNeKOUbQi_4bsJ6b7Oud8&google_cver=1
Request Chain 483
  • https://dsum.casalemedia.com/pbusermatch?origin=prebid&site_id=945271&p=1&i=0&gdpr=0&gdpr_consent=&us_privacy=1--- HTTP 302
  • https://rtb.adentifi.com/CookieIndex
Request Chain 484
  • https://eb2.3lift.com/sync?px=1&src=prebid&us_privacy=1---& HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=3658&xuid=db51a350-c421-4780-94b8-db6155d007ec&dongle=0cfd&gdpr=0&gdpr_consent=
Request Chain 569
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:6swk5ma&fmt=3 HTTP 302
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec HTTP 302
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
Request Chain 570
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:z2z62d3&fmt=3 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
  • https://tags.bluekai.com/site/5386?id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZGI1MWEzNTAtYzQyMS00NzgwLTk0YjgtZGI2MTU1ZDAwN2Vj&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec HTTP 302
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec&google_gid=CAESEGF0PBlV1wdoSEgoAmp5hzY&google_cver=1 HTTP 302
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=db51a350-c421-4780-94b8-db6155d007ec&_origin=1&redir=true&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-G2eQr7xE2uLLtZa3EDZBKIx2lfSJnbM-~A&gdpr=0
Request Chain 571
  • https://insight.adsrvr.org/track/pxl/?adv=64gxdrp&ct=0:1ingnzv&fmt=3 HTTP 302
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec HTTP 302
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
Request Chain 586
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=fbDKml90amV0bXg2enFNMG9EVXhtTGp1MmhEOCUyQnRsdGQ5TWVFeGkxJTJGcGpIeG5QTHJrT3JnQjAlMkJiMWVzN1FqSXlDMmoxMlY1NGZwM09oYXFaOHBJUGJxQ3lzVG9kU3BCajNHMDZOOWk2SHlJQkc2NmUxOFVkcWV1JTJCY3BERGNzYkFnNXJJY2dDcEx5UUNjSXRjOUZxWHlsOUZRUSUzRCUzRA&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=Or9Jl3xqSlYra1VxcnkrVmlMQmNhK2p0WDJML1hLNnJ6ZDRmMjQvNW9MZjhGS1gzVzZ4YUxqekNGZ2JMSGkyeGZJeXVpemI1NmZJeXRibk0xc0pkVHRvR1U2aDI5ZjJocUxtSUJiVEZaaDhwR0l4MEw1Ymlmdm5wQ2R2R2xEM25Ub0ViakJHODlBRFIvWnFXRHdBRUZaTjJhZTFOZUhxRUV4UDdCMlp0WnluSERFV0J1a3VwZXdBYVBTODZqaHY3bC9ISlk5ME1TNkthQlVFQnF2OGF1c3N1alpKeDM3b1c0NTU5eTl5MmlucmVoTVZFc3hOamJEUG95bVMvZmMxbXZ2NzZuZWdJY3d2Y3oxbU90b3pZd2VSWVpWTGszY3NqN0NJRFZXbkpxYW10U29RTT18&cppv=2
Request Chain 588
  • https://sb.scorecardresearch.com/c2/6035443/cs.js HTTP 302
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
Request Chain 626
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%3Duid%3A%5BMM_UUID%5D HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Request Chain 627
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent= HTTP 303
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFRFVrN0pKQU1BQUNST3RPSXU5Zw&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 302
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1 HTTP 303
  • https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AAEDUk7JJAMAACROtOIu9g&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_current_partner%3Dsyn%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D2&gdpr=0 HTTP 307
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=2 HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEDUk7JJAMAACROtOIu9g&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee_sync_current_partner%3Dsas%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D3%26userid%3DSMART_USER_ID&gdpr=0 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=4777538607685951564&gdpr=0&gdpr_consent= HTTP 303
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAEDUk7JJAMAACROtOIu9g&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D4777538607685951564%26gdpr%3D0%26gdpr_consent%3D%26bee_sync_partners%3Dpm%26bee_sync_current_partner%3Dpp%26bee_sync_initiator%3Dadx%26bee_sync_hop_count%3D4&gdpr=0 HTTP 302
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=4777538607685951564&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AAEDUk7JJAMAACROtOIu9g&pid=558502&do=add&gdpr=0 HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEDUk7JJAMAACROtOIu9g&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Request Chain 628
  • https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent= HTTP 303
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_a029244c9d2a48d68c380 HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Request Chain 629
  • https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3321274862842215126&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Request Chain 630
  • https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=TsbVTkjDjUpVk9xKT8TBSUrD3E1Vk9lFT8Zhr1Cj HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Request Chain 637
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent= HTTP 302
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=987f2e3bf4c23e8&is_secure=true&networkId=17100&version=1&nuid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHPMPxJ_kugQMC7ljAAAAAAAA&expiration=1687376685&nuid=479CC621-B2E0-490D-8915-42055EBBC0EB&is_secure=true&gdpr_consent=&gdpr=0 HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent= HTTP 302
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33646_104945626_B755AE54&r=https://pmp.mxptint.net/sn.ashx?ak=1 HTTP 302
  • https://pmp.mxptint.net/sn.ashx?ak=1
Request Chain 638
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=dc345a35-a603-4ec3-b75a-7bd7631cedf4&gdpr=0&gdpr_consent= HTTP 302
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Request Chain 639
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb2-useast.marketiq.com/sync?exchange=685&ssp=pubmatic&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.marketiq.com%2Fsync%3Fexchange%3D685%26ssp%3Dpubmatic%26bsw_param%3D2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://rtb2-useast.marketiq.com/sync?adkuid=A4735317727298828258&exchange=685&ssp=pubmatic&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=458&user_id=A4735317727298828258&expires=5&ssp=pubmatic&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 682
  • https://pixel.sojern.com/pixel/img/291730?p_v=1&f_v=v3_image&vid=hot HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=18I0X57OKGIAKLB1x3NZDA&google_nid=sojern__adx_open_bidder_seat&sjrn_id=Fnd3SPj50dGvmJFnA7WDI-NSx8O9Y26i7IY4OHYg2TCWvdTElyvkqtA9WVeYBynR&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_ula=6514084203 HTTP 302
  • https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=Fnd3SPj50dGvmJFnA7WDI-NSx8O9Y26i7IY4OHYg2TCWvdTElyvkqtA9WVeYBynR&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_ula=6514084203&google_gid=CAESEMvO9nfQq9fa3SYmHw8Vt2o&google_cver=1 HTTP 307
  • https://secure.adnxs.com/px?id=1528961&t=1
Request Chain 708
  • https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=37Wunos71Ooo&ev=1&pid=560288&gdpr_consent=&gdpr=0
Request Chain 709
  • https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%3D%23GDPR_CONSENT%23&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=2889108176641716303&gdpr=0&gdpr_consent=
Request Chain 710
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=
Request Chain 711
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partneruserid%3DPARTNER_USER_ID%26gdpr%3DGDPR%26gdpr_consent%3DGDPR_CONSENT&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=aba53805585c3b3f5f03fcf3ef82f98f&gdpr=0&gdpr_consent=0
Request Chain 712
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
Request Chain 722
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=_IOwol90amV0bXg2enFNMG9EVXhtTGp1MmhEZzNiVXBLOXFMT1laa1NCOWxudmVWeHRPcmNvenhwb0ozejBadzFsZlJrdTF1VWdGdjBmTiUyQktLQlRBZldhWVppZE9RMHczYVpFVmw1cXYxUmRBb0JBQmJ0diUyQlBRQXRPOEdqY2pMc2N3Uk9aa1U1MjhaT3RjWmZ1Q0tGc0d5cEdRJTNEJTNE&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=YugKPnxEVVNrMWtVRFJqV0wxWUlhblN0VTFaQWxjb0NuQjI1YjFvQkNtTUhFSFkxdW1VMzVWWHpJKzBSRGFadXZvelpKYS9VTDl4czE4OUt3UVZoaFNwWnJ1Tkc4STdiVTRyLzZTdnIxTDY3bFY0ZnlUdzdrY1VkaE1tOXRUdzlJS2tScjZyK09GNWtpRGhDTzhocDk5ckJScTNuU0pUV1lyS1ppY2JPY2RyZkNEWTFtMi81dnJINS90SUNpeENJa0t5WHd0Ni82Qnhrc3FrZDNjWUFMbmh3a2ZlNTd0WG1MZ0ZTa1BRN2trd2crYjlOMTNjVjRGTFNxSnNCeE14ZWYvdGsrWXNycU1ZOFU2di9qV0FhTWxlb2VnT1dZakRyQXpGc0p0T1E1Q3R4amNNaz18&cppv=2
Request Chain 760
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e5c920de-0fa2-11ee-876c-8dbcb6804b27
Request Chain 761
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@ HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Request Chain 762
  • https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
Request Chain 763
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:09wHc8i51QbHhu5&gdpr=0&gdpr_consent=
Request Chain 764
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=cde16cd9-d9ed-4cdd-9d7f-cd6930766499&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=${PUBMATIC_UID} HTTP 302
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=479CC621-B2E0-490D-8915-42055EBBC0EB
Request Chain 765
  • https://ums.acuityplatform.com/tum?umid=6 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501305684
Request Chain 766
  • https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent= HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Request Chain 767
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID} HTTP 302
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Request Chain 768
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2310082572 HTTP 302
  • https://sync.1rx.io/usersync/tradedesk/db51a350-c421-4780-94b8-db6155d007ec HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%3D%26piggybackCookie%3DRX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005 HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 769
  • https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token} HTTP 307
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Request Chain 770
  • https://gocm.c.appier.net/pubmatic HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=EBt_tnDEDsSGBBPtsQGSZA
Request Chain 772
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=d93de280-8ab8-456d-b53b-9ab646fa4468
Request Chain 775
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID HTTP 302
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7405766881343085934&uid=Q7405766881343085934&ref=%2Fepm HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766881343085934
Request Chain 776
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:8B59A33699C741AFA2C7A091E574C7C9&gdpr=0&gdpr_consent=
Request Chain 777
  • https://idsync.rlcdn.com/712188.gif?partner_uid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent= HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=92b7f04663d835edece4cb34207788586f982d0c9d178d6b1998e33b4119b735791426b5417dce21&_=2 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA5MmI3ZjA0NjYzZDgzNWVkZWNlNGNiMzQyMDc3ODg1ODZmOTgyZDBjOWQxNzhkNmIxOTk4ZTMzYjQxMTliNzM1NzkxNDI2YjU0MTdkY2UyMRAAGgwIsIPIpAYSBAgCEABCAEoA HTTP 302
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA5MmI3ZjA0NjYzZDgzNWVkZWNlNGNiMzQyMDc3ODg1ODZmOTgyZDBjOWQxNzhkNmIxOTk4ZTMzYjQxMTliNzM1NzkxNDI2YjU0MTdkY2UyMRAAGgwIsIPIpAYSBAgCEABCAEoA&google_gid=CAESEFVCqCxwUCSrUoWCTuNA2E4&google_cver=1 HTTP 307
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
  • https://idsync.rlcdn.com/458249.gif?partner_uid=365f9e71-e58f-498c-87fb-3ce6d43b34a3
Request Chain 781
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COOKIES%20HERE]&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1235390588561432912
Request Chain 782
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3321274862842215126
Request Chain 783
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent= HTTP 302
  • https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:8e573587-b904-4733-a2c4-ff0a85ac28aa&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Request Chain 797
  • https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%40&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=fbc3b4d9-a11b-4371-a88d-35e24043ca77&gdpr=0&gdpr_consent=
Request Chain 798
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent= HTTP 303
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEDUk7JJAMAACROtOIu9g&gdpr=0
Request Chain 799
  • https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=111&partneruserid=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F8%2F2.gif%3Fpuid%3DSMART_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/102/102/8/2.gif?puid=4777538607685951564&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
  • https://cookie-matching.mediarithmics.com/v1/get_user_agent_id?dom_token=id517&gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY HTTP 303
  • https://cookie-matching.mediarithmics.com/v1/get_or_create?gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&domid=1033 HTTP 303
  • https://cm.g.doubleclick.net/pixel?google_nid=medr&google_cm&key=GOO&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&gdpr_consent=&gdpr=0&action=GET_ID&opid=goo&etid=&domid=1033&ops=apx HTTP 302
  • https://cookie-matching.mediarithmics.com/input?key=GOO&key=GOO&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&gdpr_consent=&gdpr=0&action=GET_ID&opid=goo&etid=&domid=1033&ops=apx&google_gid=CAESEJv49rfB51JSFqaB7F22XtY&google_cver=1 HTTP 303
  • https://ib.adnxs.com/getuid?https://cookie-matching.mediarithmics.com/input?key=APX&apx_uid=$UID&opid=apx&ops=&utidl=tech:goo:CAESEJv49rfB51JSFqaB7F22XtY&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&gdpr_consent=&gdpr=0&action=GET_ID&etid=&domid=1033 HTTP 302
  • https://cookie-matching.mediarithmics.com/input?key=APX&apx_uid=3321274862842215126&opid=apx&ops=&utidl=tech:goo:CAESEJv49rfB51JSFqaB7F22XtY&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&gdpr_consent=&gdpr=0&action=GET_ID&etid=&domid=1033 HTTP 303
  • https://id5-sync.com/qp/18.gif?puid=vec%3A38886178730&gdpr=0&gdpr_consent=&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY HTTP 302
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F104%2F6%2F4.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/102/104/6/4.gif?puid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent= HTTP 302
  • https://cookie-matching.mediarithmics.com/v1/get_user_agent_id?dom_token=id517&gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY HTTP 303
  • https://id5-sync.com/qp/18.gif?puid=vec%3A38886178730&gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY HTTP 302
  • https://match.prod.bidr.io/cookie-sync/id5?us_privacy= HTTP 303
  • https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AAEDUk7JJAMAACROtOIu9g HTTP 302
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F104%2F3%2F7.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/102/104/3/7.gif?puid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent= HTTP 302
  • https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F10%2F2%2F8.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
  • https://id5-sync.com/c/102/10/2/8.gif?puid=1235390588561432912&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.richaudience.com/a6c163b098d05a413cd1682e26fae172/?uid=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A
Request Chain 800
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent=
Request Chain 801
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DSMART_USER_ID&gdpr=0&gdpr_consent= HTTP 302
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4777538607685951564&gdpr=0&gdpr_consent=
Request Chain 810
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
Request Chain 811
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?&rd=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D91%26partneruserid%3D%23PM_USER_ID%26gdpr%3DPM_GDPR%26gdpr_consent%3DPM_CONSENT&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Request Chain 812
  • https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent= HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F2075%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=759507639 HTTP 302
  • https://sync.1rx.io/usersync3/mediamathtest/2075/5f956492-01a9-4900-b96e-6cf0342c9990?zcc=0&sspret=1 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 813
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
Request Chain 814
  • https://sync.mathtag.com/sync/img?mt_exid=39&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D25%26partneruserid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
Request Chain 816
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
Request Chain 817
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://id5-sync.com/s/286/9.gif?puid=397b5886-1416-4626-ba56-1zz1687290289&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.richaudience.com%2Fa6c163b098d05a413cd1682e26fae172%2F%3Fuid%3D%7BID5UID%7D HTTP 302
  • https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F434%2F8%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent= HTTP 302
  • https://id5-sync.com/c/286/434/8/2.gif?puid=2c0f44d2-6a66-40d3-a3dc-600d11c96224&gdpr=0&gdpr_consent= HTTP 302
  • https://inmobi-match.dotomi.com/match/bounce/current?networkId=98193&version=1&gdpr=0&gdpr_consent= HTTP 302
  • https://inmobi-match.dotomi.com/match/bounce/current?DotomiTest=62a4a683ab1d145f&is_secure=true&networkId=98193&version=1&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/822.gif?puid=AAAMuMw_h2LY3QM08ejhAAAAAAA&expiration=1687376691&is_secure=true&gdpr_consent=&gdpr=0 HTTP 302
  • https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F286%2F124%2F6%2F4.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/cq/286/124/6/4.gif?puid=92e9d51d-f58b-4a55-97b2-6ee67deb9268&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
  • https://match.prod.bidr.io/cookie-sync/id5?us_privacy= HTTP 303
  • https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AAEDUk7JJAMAACROtOIu9g HTTP 302
  • https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F821%2F4%2F6.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 307
  • https://id5-sync.com/c/286/821/4/6.gif?puid=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr=0&gdpr_consent= HTTP 302
  • https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F136%2F3%2F7.gif%3Fpuid%3D%24%7BTM_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/286/136/3/7.gif?puid=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent= HTTP 302
  • https://token.rubiconproject.com/token?pid=49266&puid={ID5UID}&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/285.gif?puid=LJ4P2KW9-15-LLQ7&gdpr=0 HTTP 302
  • https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F286%2F916%2F1%2F9.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
Request Chain 819
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F2069.66%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=5989968298 HTTP 302
  • https://sync.1rx.io/usersync3/mediamathtest/2069.66/5f956492-01a9-4900-b96e-6cf0342c9990?zcc=0&sspret=1 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 822
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Request Chain 824
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 831
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Request Chain 832
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/5d62234a37f0646bf2303b81bf9e9a9f?gdpr_consent=&gdpr=0
Request Chain 835
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 841
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?&rd=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D91%26partneruserid%3D%23PM_USER_ID%26gdpr%3DPM_GDPR%26gdpr_consent%3DPM_CONSENT&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Request Chain 842
  • https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent= HTTP 302
  • https://stags.bluekai.com/site/23178?id=oRzH9Zt83axgglTEQFsr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC4TUNZSXE5LTMVZGSZB5N5JHUSBZLJ2DQM3BPBTWO3CUIVIUM43S&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC4TUNZSXE5LTMVZGSZB5N5JHUSBZLJ2DQM3BPBTWO3CUIVIUM43S HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=oRzH9Zt83axgglTEQFsr
Request Chain 845
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=45bb695b-34f1-45bc-b104-fd1bfa86c044&gdpr=0
Request Chain 846
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 853
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent=
Request Chain 854
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
Request Chain 855
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent= HTTP 307
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr_consent=null&gdpr=0
Request Chain 856
  • https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent= HTTP 302
  • https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=smartadserver HTTP 302
  • https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=smartadserver HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=48af5e8d-0e41-4408-b340-0efe3a2b26fc&ssp=smartadserver HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=
Request Chain 857
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Request Chain 877
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
Request Chain 880
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://x.bidswitch.net/sync?ssp=richaudience&gdpr=0&gdpr_consent=&user_id=397b5886-1416-4626-ba56-1zz1687290289 HTTP 302
  • https://ads.betweendigital.com/match?bidder_id=43092&gdpr=0&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Drichaudience%26expires%3D30%26user_group%3D%24%7BUSER_GROUP%7D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=429&user_id=e85e87b7-5c57-53ab-9b57-f4bcffc5f50d&ssp=richaudience&expires=30&user_group=1&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=&us_ps=
Request Chain 881
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005&rndcb=5442216007 HTTP 302
  • https://t.pswec.com/bsw_sync?ssp=adconductor&bsw_user_id=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://t.pswec.com/ul_cb/bsw_sync?ssp=adconductor&bsw_user_id=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=2&user_id=7ad943f4-c122-4afd-821a-f70b289c410c&expires=3&user_group=1&ssp=adconductor HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/2491035f-3b91-450a-bf47-d3da43a3fb7b?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 882
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID HTTP 307
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
Request Chain 886
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Request Chain 887
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsync.richaudience.com%2F1a12a024f8f9561c49164bbaf87ed164%2F%3Fuid%3D[sas_uid]&gdpr_consent=&nwid=2441/ HTTP 302
  • https://sync.smartadserver.com/getuid?url=https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=[sas_uid]&gdpr_consent=&nwid=2441/&cklb=1 HTTP 302
  • https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4777538607685951564
Request Chain 888
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 889
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005&rndcb=6632179801 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b&google_hm=MjQ5MTAzNWYtM2I5MS00NTBhLWJmNDctZDNkYTQzYTNmYjdi HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESECMp9F8FTIWYgeQlriR_w6E&google_cver=1&ssp=adconductor&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/2491035f-3b91-450a-bf47-d3da43a3fb7b?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005 HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 890
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Request Chain 893
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Request Chain 894
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/f39057767042789454688717f4d2f3ca?gdpr_consent=&gdpr=0
Request Chain 895
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 896
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://match.prod.bidr.io/cookie-sync/richaudience&gdpr=0&gdpr_consent= HTTP 303
  • https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
Request Chain 897
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F HTTP 302
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1 HTTP 303
  • https://match.prod.bidr.io/cookie-sync/richaudience&gdpr=0&gdpr_consent= HTTP 303
  • https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
Request Chain 902
  • https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent= HTTP 302
  • https://stags.bluekai.com/site/23178?id=oRzH9Zt83axgglTEQFsr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC4TUNZSXE5LTMVZGSZB5N5JHUSBZLJ2DQM3BPBTWO3CUIVIUM43S&gdpr=0 HTTP 302
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC4TUNZSXE5LTMVZGSZB5N5JHUSBZLJ2DQM3BPBTWO3CUIVIUM43S HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=oRzH9Zt83axgglTEQFsr
Request Chain 903
  • https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005&rndcb=5224921595 HTTP 302
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent= HTTP 302
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=1d360e72-ed0a-468d-af20-61ff2dc87248&ssp=adconductor&expires=30&user_group=5&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b HTTP 302
  • https://sync.1rx.io/usersync/bidswitch/2491035f-3b91-450a-bf47-d3da43a3fb7b?gdpr=&gdpr_consent= HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 904
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc%26google_hm%3DSMART_USER_ID_B64&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEN6Bv2XV7wpWXcvjVaO6wck&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 905
  • https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%26partneruserid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=318dfbf2-48b4-46ac-b8e6-a6e824a12e17
Request Chain 906
  • https://dsp.adfarm1.adition.com/cookie/?ssp=5&gdpr=0&gdpr_consent= HTTP 302
  • https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7246856614452983954&gdpr=0&gdpr_consent=
Request Chain 910
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 911
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Request Chain 912
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&rndcb=7976228035 HTTP 302
  • https://sync.1rx.io/usersync/rubicon/LJ4P2KW9-15-LLQ7 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 914
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&rndcb=320679509 HTTP 302
  • https://sync.1rx.io/usersync/rubicon/LJ4P2KW9-15-LLQ7 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 915
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 916
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/922b9b5de53a83057b6ee4965f3d361?gdpr_consent=&gdpr=0
Request Chain 917
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Request Chain 918
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Request Chain 920
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Request Chain 921
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 922
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 923
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 924
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 925
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Request Chain 926
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Request Chain 927
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Request Chain 928
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/c73f079468a9778d6dba7d2f5443dc3?gdpr_consent=&gdpr=0
Request Chain 929
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/f76549c7243c44b1d97f895bf5069c2?gdpr_consent=&gdpr=0
Request Chain 930
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 932
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 934
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 935
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 936
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Request Chain 937
  • https://creativecdn.com/cm-notify?pi=smilewanted HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Request Chain 939
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%26f%3Di%26uid%3D%24UID HTTP 302
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
Request Chain 940
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%26f%3Di%26uid%3D%24UID HTTP 302
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
Request Chain 943
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:479CC621-B2E0-490D-8915-42055EBBC0EB HTTP 302
  • https://io.narrative.io/?io.narrative.guid.v2=ebe4c0e1-0fa2-11ee-a591-0a3986670f6f&companyId=673&id=pubmatic_id:479CC621-B2E0-490D-8915-42055EBBC0EB
Request Chain 944
  • https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=479CC621-B2E0-490D-8915-42055EBBC0EB HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=ZzJiaHNYNmJkMXRSNEttWDNkcXYtdnRHZw==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%253D%253D%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://a.audrte.com/a?adform_uid=1235390588561432912&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D HTTP 302
  • https://a.audrte.com/p
Request Chain 950
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/8e94c585-96a4-4941-b2e1-1zz1687290289
Request Chain 951
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted HTTP 302
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=110&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fcentro%2F2069.66%2F%7BuserId%7D%3Fzcc%3D0%26sspret%3D1&rndcb=3172524110 HTTP 302
  • https://sync.1rx.io/usersync3/centro/2069.66/08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341?zcc=0&sspret=1&rndcb=3172524110 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005 HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Request Chain 952
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Request Chain 953
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Request Chain 954
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID HTTP 303
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Request Chain 955
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent= HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Request Chain 956
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID} HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Request Chain 957
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%26f%3Di%26uid%3D%24UID HTTP 302
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
Request Chain 959
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid] HTTP 302
  • https://csync.smilewanted.com/set_partner_userid_get/smart/4777538607685951564
Request Chain 961
  • https://creativecdn.com/cm-notify?pi=connectad HTTP 302
  • https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=RrG2QWcZ9j7dv54OJsuG&pi=connectad
Request Chain 962
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dsovrn%26dataid%3Ddata12%26uuid%3D%24UID HTTP 307
  • https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgbPZHuyVpOjRtQ-i3ojE3
Request Chain 963
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dadform%26dataid%3Ddata4%26uuid%3D%24UID HTTP 303
  • https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1235390588561432912
Request Chain 966
  • https://x.bidswitch.net/sync?ssp=rtaplus&user_id=WO8dHzCc5VwX4NQ47Y5w94la1DNoDjurpcn5rgPp&gdpr=0 HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=46&redir=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D80%26user_id%3D%5BUUID%5D%26expires%3D30%26ssp%3Drtaplus%26bsw_param%3D2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=80&user_id=5f956492-01a9-4900-b96e-6cf0342c9990&expires=30&ssp=rtaplus&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent= HTTP 302
  • https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Request Chain 970
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJIBqAABSFKRcAAz
Request Chain 973
  • https://match.adsrvr.org/track/cmf/openx?oxid=24046c0a-d976-79c0-ff74-18d402b2f5d1&gdpr=0 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=db51a350-c421-4780-94b8-db6155d007ec&ttd_puid=24046c0a-d976-79c0-ff74-18d402b2f5d1&gdpr=0&gdpr_consent=
Request Chain 975
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAxm-FWt34UsFpBDa5fkU7Q&google_cver=1
Request Chain 976
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJIBqAABSFKRcAAz
Request Chain 977
  • https://match.prod.bidr.io/cookie-sync/ie HTTP 303
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAEDUk7JJAMAACROtOIu9g&expiration=1688499892
Request Chain 978
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1 HTTP 302
  • https://casale-match.dotomi.com/match/bounce/current?DotomiTest=648cdd480c16184a&is_secure=true&networkId=19998&version=1 HTTP 302
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAHPMPxJ_kwXAMTA-5_AAAAAAA&expiration=1687376692&is_secure=true
Request Chain 979
  • https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 302
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703101493&external_user_id=4ed84149-74cb-4089-8a62-fd46691017b4
Request Chain 980
  • https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid= HTTP 307
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=ff76b2fa-a2e6-48d5-8a14-13731d407294&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
Request Chain 981
  • https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=ZJIBqD7bZiR98t4YH35qSwAA%263485&gpp=&gpp_sid= HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
Request Chain 991
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=Dt5YhXw2cEp1ZTd2ZTVQTS9teHBzRk9DK2cwMUZzbkptL2h0dlBJNTJNTTVBYk5MZTVja1I4bk9uRzlBU0l4dXZqYUg0ZjBtN3Q0SHJrKzRsSXFnZUZxdENqQmQ1Rzl2bE9PRFBSK3ZHQWZPM2JrY3pucHZBYjVsb3JqZFM2WThzV1lWUm5YcUppL08zdUJtZ3JORHppVm1jQVlaMEZjWDBzK0xraVk5OHZMTHdEc0dJWTRnaXFvbllMbGV6bmY5WUJvaUlKOWJtazg5SEhzU2xhbFBoVmtXekdlRmVwRVZyVndnaXN4SVdpYXNYMWFRV0kzb2NaVlRwakdNa1VHYjhjRUtCUm0rUXhld1pZR090a0E1aUdNUVJ5citqeTBpUDJjaDN6YzRNZVpDQ2dCUT18&cppv=2
Request Chain 999
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=2&topUrl=www.mercurynews.com&bundle=VYhnal9RVGZMOUkxWGRNRHlHcHFhYnU5ZyUyRkxjWmcyQnFiVnRaZDlVVjBUcFlRaUQ5NHh2NTBlQjZWbm9MbEUxbEY1RnBva2pUR0Q5QyUyRkdCTlVDcWp1MzFrOVd1SUFZMiUyRld2NjRkUjlkeWVkUFhpRTFmNGFSM0FoU3haaHhqbVFNeWZMNTAwT0ZkRFRLeG1xdndGUWV2SXoydWclM0QlM0Q&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=hd-KdnwyNy9xY285a0JsWFRmUGJOdEJmdEx6ZDBoTDQvL2tPQXNrSzN0ZmowYnAwSitScnVaOGlOdVFzOHhiaXA5WEhrOWVBLzQ1bEFHTGxCak5yRUNCSzBoNERtRTRRRGUzK3hSQWlxTUFFZlZrMmtjSTNSMWF6OWxPL2lnbk5TN0hyQUVQK0IrUlMvNVFQTEFaakdSZW1YQnovODcxOWViZTNmaG83VHBFc1F4eklZajZRaWpWcmozb1dxQU5qeTdMM09ST2Z6TEYwN1NVUzl6SGZ5N2NPb095amdaL3poUlJ0N3N6bnRVMithMk9LVnpyVkF0bm10Snl3T3RKNUZzMS9KaEdIUEVHbmRGZDFQQ1JoTW5PeTk1SjFkVGpxNm5oMkVuSFAvU0FjMEpRaz18&cppv=2
Request Chain 1000
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=2&topUrl=www.mercurynews.com&bundle=VYhnal9RVGZMOUkxWGRNRHlHcHFhYnU5ZyUyRkxjWmcyQnFiVnRaZDlVVjBUcFlRaUQ5NHh2NTBlQjZWbm9MbEUxbEY1RnBva2pUR0Q5QyUyRkdCTlVDcWp1MzFrOVd1SUFZMiUyRld2NjRkUjlkeWVkUFhpRTFmNGFSM0FoU3haaHhqbVFNeWZMNTAwT0ZkRFRLeG1xdndGUWV2SXoydWclM0QlM0Q&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=jtnSFXxSSG5DM0IrNEQ1M25nOFZPTENhNm1WUEJZTnRSRWRCeUFpRG9nTFIwcTE4clhhNGpPUUh1bzFEcktFRG4yNTZXeTVub2twZ3JUKzJreHA3QSs5NUlLV3pYQnFyS1BVN3FlbWppRm9FQWN5ek5iclc5bFdOSWtLam13NUcramZZNC9PTllOSjhsYm5Mb0EvSThQRElNNEM0U3hJTm1LQlVFL0Q0cW1qSGVsYndkWTI3d3puYTJVd0ltSGpjUVRpZ21jTWJ0LzZ0bTFXdlVIODVHL2dUVzV3Z2J1YnhVVXdINlQwRzMyVlZFQURGWi9TcXJZSkJaaWhMS0p1aUdxUVIwbElsZDQvVFdIS2hGVkd0anVjZ21Gb2oxbHdlT0pUS2VLQTVMdWtCNGFtYz18&cppv=2
Request Chain 1001
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=2&topUrl=www.mercurynews.com&bundle=VYhnal9RVGZMOUkxWGRNRHlHcHFhYnU5ZyUyRkxjWmcyQnFiVnRaZDlVVjBUcFlRaUQ5NHh2NTBlQjZWbm9MbEUxbEY1RnBva2pUR0Q5QyUyRkdCTlVDcWp1MzFrOVd1SUFZMiUyRld2NjRkUjlkeWVkUFhpRTFmNGFSM0FoU3haaHhqbVFNeWZMNTAwT0ZkRFRLeG1xdndGUWV2SXoydWclM0QlM0Q&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=GS-4jXxUaTVua2l1V0RYaXpFbURXaTlvRUlZdWE2ZW9MblhOQjNxWEtEMDVlNndDWFQ1cmhMbGI3SzRWellFaGJkZDd0VUYyMzFvOHViWFgrb2Z1UXE2UjBCN3ZoQzFrN1BxOWlJUHVFd1p6VkRMTExZUEtZdGdxdUtucFJ2bk9NT3VZL1o5TXUrMlA2akZXcWo0R3pXa3RWQ0ZSeTE4Y2JKMFNicjRGTFpCbjRyM2hKSG9nQmdIUHRFYTFjQ01GalhiQUxZcE5HZk5JS0ZyeDluaXJsYWtGZzc0TWVLOXhBMkhERFRPSG9vWXh4NmQ1R0lwbllkdFRFUFRCY1J2SUw3QUhudTZOenJsQkVrQmlZZkpjTzhzMjdPZnNQL1ZGM2xoTGZlTXpENGhmaTUxRT18&cppv=2
Request Chain 1003
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=2&topUrl=www.mercurynews.com&bundle=VYhnal9RVGZMOUkxWGRNRHlHcHFhYnU5ZyUyRkxjWmcyQnFiVnRaZDlVVjBUcFlRaUQ5NHh2NTBlQjZWbm9MbEUxbEY1RnBva2pUR0Q5QyUyRkdCTlVDcWp1MzFrOVd1SUFZMiUyRld2NjRkUjlkeWVkUFhpRTFmNGFSM0FoU3haaHhqbVFNeWZMNTAwT0ZkRFRLeG1xdndGUWV2SXoydWclM0QlM0Q&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=5f6G6nxOdit3aENZTWM4NmNjdVQ0aVFRQms3bXV0ajBrMTNvc3RsZzdjUmVqRGwyQWMreVpPL3N2RU1ZNjhVZktPZldzYjBYT0ozODl0aWx5MUM1S2kwalVGTXlDUFVCMEt6Rkcyc1BWRmd0VkZMZElQS1pCUkhQK3plOGRDQzkyUkJXK2JGVVJsWTNkMG5YcEtiNDJUcS9FNUVpSVJDZjRJaFJOSmw2aDkxbzdJSkFqcjhrS2FLVnRRRW13bEppK05yelhRZU53eUNVVTYwQjlGMVV4dGxSTTlTeHpOYWFlN2xYb3lNSnBsRlF2N2tJZ0wvUXR0VGlxaTduRzk0ellTSDFja2w4QnlJZHJoSktobm9MbFZuakpmcDRjeFROV0ZTZmxvVnNaR0NTd2QxWT18&cppv=2

999 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Redirect Chain
  • http://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
  • https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
216 KB
50 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx / WordPress VIP <https://wpvip.com>
Resource Hash
d31d9df7808e6c73f1d25efb83730a1dcb32f0bd3b7ec132da7cf7bbfd6f5d61
Security Headers
Name Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
2997
cache-control
max-age=300, must-revalidate
content-encoding
gzip
content-length
50004
content-security-policy
default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:36 GMT
host-header
a9130478a60e5f9135f765b23f26593b
link
<https://www.mercurynews.com/wp-json/>; rel="https://api.w.org/" <https://www.mercurynews.com/wp-json/wp/v2/posts/9968021>; rel="alternate"; type="application/json" <https://wp.me/p7ShJJ-FP8x>; rel=shortlink
server
nginx
strict-transport-security
max-age=31536000;includeSubdomains
vary
Accept-Encoding
x-cache
grace
x-hacker
If you're reading this, you should visit wpvip.com/careers and apply to join the fun, mention this header.
x-powered-by
WordPress VIP <https://wpvip.com>
x-rq
yyz2 85 187 443

Redirect headers

Connection
keep-alive
Content-Length
162
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:36 GMT
Location
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Server
nginx
boldcoastal.css
www.mercurynews.com/wp-content/themes/assets/static/css/ 		416 KB
63 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/css/boldcoastal.css?ver=1686774969
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c6038de77c2fca2f75327c1e7ec4751a8d45cc3737395a2abe403ac6d8e98144
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz2 85 187 443
etag
W/"648a24b4-6808c"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
wp-emoji-release.min.js
www.mercurynews.com/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-includes/js/wp-emoji-release.min.js?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 22 May 2023 14:14:06 GMT
server
nginx
x-rq
yyz2 85 188 443
etag
W/"646b78ae-4904"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
htlbid.css
htlbid.com/v3/mercurynews.com/ 		3 KB
693 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://htlbid.com/v3/mercurynews.com/htlbid.css?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.60.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-60-51.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2f218961fc995f27f5868268ca3f765d4e7066eb6144139ce5b9eefe9b9ad443

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
br
via
1.1 b7a66b6616123855c5af2d7cdf2b099e.cloudfront.net (CloudFront)
last-modified
Mon, 05 Jun 2023 22:43:44 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C1
age
565
x-amz-server-side-encryption
AES256
etag
W/"d0ed30e2f703616022754e56fc09aa63"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
cache-control
max-age=600
x-amz-cf-id
G0BBF8S1t7_xr5j5P5ezBIl-Yw14nZ5-HvSn35gY2yegGG1egD56Sg==
style.css
www.mercurynews.com/wp-content/client-mu-plugins/src/Sitemap/includes/ 		880 B
392 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/client-mu-plugins/src/Sitemap/includes/style.css?m=1676299207g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c540cdeba4eb897beea1c93c6452269a4de7b86a2e670b5b0ad37f9bbfc78c53
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 13 Feb 2023 14:40:07 GMT
server
nginx
x-rq
yyz2 85 188 443
etag
W/"63ea4bc7-370"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
/
www.mercurynews.com/_static/ 		31 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0f27b15848fb3a09df5fa1ba8e2ae9a80ca73faca61455767cd28318fd3c2c6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz2 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
mng-digisubs.styles.css
www.mercurynews.com/wp-content/plugins/mng-digisubs/static/ 		14 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/mng-digisubs/static/mng-digisubs.styles.css?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
aff8084000d2c0e029860444700f6c44b5d0124101ae9f87a9bb7d6b574fe24e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz2 85 188 443
etag
W/"648a24b4-385c"
vary
Accept-Encoding
x-cache
HIT
content-type
text/css
cache-control
max-age=31536000
/
www.mercurynews.com/_static/ 		848 B
433 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??/wp-content/plugins/site-plugins/site-bang/static/css/screen.min.css,/wp-content/client-mu-plugins/src/Ads/assets/css/mobile-adhesion-style.css?m=1676299207
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
af791f4ecfb200dd519a03dc1760721fd4fc36cd3ef9f0b5caf592f9a3d49b91
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Mon, 13 Feb 2023 14:40:07 GMT
server
nginx
x-rq
yyz2 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
bootstrap-icons.min.css
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/ 		56 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:44:36 GMT
x-content-type-options
nosniff
content-encoding
br
age
6091565
x-jsd-version
1.5.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
8819
x-served-by
cache-fra-eddf8230021-FRA, cache-yul12832-YUL
x-jsd-version-type
version
etag
W/"e199-MKfLdwDci4zij+cy307LMP/uJk4"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
css
fonts.googleapis.com/ 		4 KB
953 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
270fb1f5320e32a7e0b8af9d3102063d8eb8950f4feb0ce3bb6c00536c1daa60
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 19:23:07 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:44:36 GMT
/
www.mercurynews.com/_static/ 		109 KB
26 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyNkN0KwjAMhV/ING74sxvxUaS03ai2TVlSx97eDhwoKniXk+R8nASnDIaSuCSYQxl8YrR9BG0hkmVk0eINGq6lGZ1LKvqkqtzgD+fd657KqCGPJCRzdivkdapY5uD4gxQLrLCrk6zNDZpWtVjDlLqPk7eDE0ahDJlYloQV9Dfn4pNBJuN1gEAD8Zv4etwv1PKTZ2PxnOOpOXTHttvu9u0DeIF9tg==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f42437392991256301d04a743ae9c380aae62faef9a5bb0d4dde967ae9681df9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 20 Jun 2023 17:00:52 GMT
server
nginx
x-rq
yyz2 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
text/css;charset=utf-8
cache-control
max-age=31536000
htlbid.js
htlbid.com/v3/mercurynews.com/ 		404 KB
110 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.60.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-60-51.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0e8e9fab28b24199f9d2b90a2b0996495b9d68cbe71550e5c4780bbf7028296f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
br
via
1.1 b7a66b6616123855c5af2d7cdf2b099e.cloudfront.net (CloudFront)
last-modified
Mon, 05 Jun 2023 22:43:44 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C1
x-amz-server-side-encryption
AES256
etag
W/"19fe31e40e621db88498bc266f8f8880"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
application/javascript
cache-control
max-age=600
x-amz-cf-id
7IT5jow9Bavb-J-EuaV-i3Zqzb7zlRY6eN6EzkkU73j0Rn-O5jOeDw==
sso-tools.min.js
www.mercurynews.com/wp-content/client-mu-plugins/src/SSO/assets/js/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/client-mu-plugins/src/SSO/assets/js/sso-tools.min.js?m=1670967803g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
feb0e7f17014201ea9124f23e3f63965411385abf0103fc682595d0674087a0c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz2 85 188 443
etag
W/"6398f1fb-1536"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81e::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 15 Jun 2023 18:05:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
437941
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31021
x-xss-protection
0
last-modified
Fri, 08 May 2020 07:05:03 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 14 Jun 2024 18:05:35 GMT
loader.min.js
www.mercurynews.com/wp-content/plugins/loader-wp/static/ 		16 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 19:18:43 GMT
server
nginx
x-rq
yyz2 85 187 443
etag
W/"648a1293-3e4a"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
global.js
www.mercurynews.com/wp-content/plugins/bloom-for-publishers/lib/js/ 		14 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/bloom-for-publishers/lib/js/global.js?m=1670967803g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
041f41b6b98e101febe7d24b8d7fdd9fd696dabad0fbe296c978272491c2a791
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz2 85 187 443
etag
W/"6398f1fb-3985"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
js
maps.googleapis.com/maps/api/ 		188 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/js?key=AIzaSyDJUi9DGZnqI8YbyBueZXiiJjKzw9kGDlE&ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
adac5f0ac3cba09025628039e8467b22408fa62d59c8b9c1b5b7f4a412306741
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Accept-Language, Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
63735
x-xss-protection
0
auth0-spa-js.production.js
cdn.auth0.com/js/auth0-spa-js/1.13/ 		105 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.auth0.com/js/auth0-spa-js/1.13/auth0-spa-js.production.js?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2511:1000:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
6AzkYKZDwDnSxmQe5SqIWFlWTPBMtbyI
content-encoding
gzip
via
1.1 c7f059cae2da7d584bee2041395eabe8.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 19:05:27 GMT
last-modified
Thu, 07 Jan 2021 14:32:49 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P6
age
2350
etag
W/"8bea9e0d733d097381a1b5eb8c40983d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=10800,public
x-amz-replication-status
FAILED
x-amz-cf-id
DA2RM0VZOS2Et667pzQPWF98t2X6sC3qv95cMhyWGSqZXzM1mlftJw==
client
accounts.google.com/gsi/ 		192 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/client?ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::200d Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fea3b3935cf17f0cd5d5fbceab048035f7f4fa295398f3ffc1a5b4d0a030e83b
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-sdC9w84elDRLMW3U0ywdAg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-security-policy
script-src 'report-sample' 'nonce-sdC9w84elDRLMW3U0ywdAg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
application/javascript; charset=utf-8
cache-control
private, max-age=1800
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Tue, 20 Jun 2023 19:44:36 GMT
/
www.mercurynews.com/_static/ 		289 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f9e7478a7ceb5f02339cda0af1f0df3c8f3d108b1f9d5323b962017919ae555f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz2 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
pushly-sdk.min.js
cdn.p-n.io/ 		300 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.2.2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-67.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b34b500b4fe4d4f0be72fcb5b7c582c472495b1498072d19a1aaac0dc2022195

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:34:59 GMT
content-encoding
gzip
via
1.1 71994794c0ae42f7776bc799e33a979a.cloudfront.net (CloudFront)
last-modified
Sun, 18 Jun 2023 05:05:18 GMT
server
AmazonS3
x-amz-cf-pop
EWR52-C2
age
590
x-amz-server-side-encryption
AES256
etag
W/"eeaa47f53affa0eb6622b034cf68505a"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=900
x-amz-cf-id
W38jkFdiRxFKwPeA3gFW3RcKbgiWPJjKV-8H4j151ugXYeg3rCkR8Q==
dfm-pushly.min.js
www.mercurynews.com/wp-content/plugins/dfm-pushly/static/js/ 		160 B
205 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-pushly/static/js/dfm-pushly.min.js?m=1686770323g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz2 85 188 443
last-modified
Wed, 14 Jun 2023 19:18:43 GMT
server
nginx
etag
"648a1293-a0"
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
160
script.js
a869.mercurynews.com/ 		148 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/script.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
4a7cc3810e9012a315f69d1dc6a4089e5b1e8db39f1707d3dd4d22c67462bb51
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:36:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
515
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
44451
x-xss-protection
1; mode=block
last-modified
Tue, 20 Jun 2023 19:35:50 GMT
server
-
etag
01c56a5810516920801a6040449259ac
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=600
x-robots-tag
noindex, nofollow
x-amz-cf-id
-dZIFgveLjQwhRq1P739rJZJ7cQMgcMrDwiV5rGOTVAkmJn3CKXO3g==
expires
Tue, 20 Jun 2023 19:46:01 GMT
osano.js
cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/ 		351 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:aa00:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
ee004e19a65d9657ccfd05c3c15ed2a49fafecb011b8dc60c799da2fc606fdcf
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:43:59 GMT
content-encoding
br
via
1.1 9750f5ee94b45ad0faba87b3fac2aad6.cloudfront.net (CloudFront)
x-content-type-options
nosniff
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-amz-cf-pop
JFK50-P5
age
37
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
79886
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Thu, 08 Jun 2023 02:50:01 GMT
server
CloudFront
etag
"0b9c83f25e35cd08524597a129a269f9"
x-frame-options
SAMEORIGIN
vary
Origin
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=86400, s-maxage=86400, must-revalidate, proxy-revalidate, no-transform
x-amz-cf-id
fHGh7Q40k_PbddHvh_N8sz6X7_mQcXEDosqb8eLDJri-plRwd5T9yg==
mg2nw.min.js
prodmg2.blob.core.windows.net/newsletterwidget/mngcep/ 		143 KB
144 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://prodmg2.blob.core.windows.net/newsletterwidget/mngcep/mg2nw.min.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.60.62.4 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
eabc0f4a5b76ceb76d11713e56e77dc230f3672c9df4c43a79089fa69b056033

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Tue, 20 Jun 2023 19:44:36 GMT
Last-Modified
Tue, 30 Aug 2022 11:57:42 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
qpxGb9QXImzRxhdRLqrrAA==
ETag
0x8DA8A7ED8105951
Content-Type
application/javascript
Access-Control-Allow-Origin
*
x-ms-request-id
0f3b0769-501e-004e-42af-a3d936000000
Access-Control-Expose-Headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
Content-Length
146402
/
www.mercurynews.com/_static/ 		53 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??/wp-content/plugins/dfm-ad-mods/static/js/hhsl-check.min.js,/wp-content/plugins/mng-digisubs/static/mng-digisubs.articleShare.bundle.js?m=1686774964j
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
0152a088a37330522c1458229707cbc27e42f802e1ba385d887b8a0069927618
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz2 85 188 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
mn-logo.svg
www.mercurynews.com/wp-content/uploads/2020/09/ 		12 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/uploads/2020/09/mn-logo.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 23 Sep 2020 17:38:16 GMT
server
nginx
x-rq
yyz2 80 130 443
etag
W/"497950346404e2d1"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=31536000
index.js
tags.remixd.com/player/v5/ 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-63.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:11 GMT
content-encoding
gzip
via
1.1 f1742871ff3f5482a0c79a4d483d78a8.cloudfront.net (CloudFront)
last-modified
Tue, 21 Jun 2022 15:31:59 GMT
server
AmazonS3
x-amz-cf-pop
EWR50-C1
age
26
etag
"57b6f8ad4125903b7e06bb427c232d10"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
public,max-age=1800
accept-ranges
bytes
content-length
10041
x-amz-cf-id
GhWm3zuy0GNwyLnvFrI41rKGk50laf7FcW8DzWubknf6zuXjbJdE1A==
Trust-Logo-Horizontal.svg
www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/ 		7 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-trust-indicators/static/images/Trust-Logo-Horizontal.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
x-rq
yyz2 85 188 443
etag
W/"6398f1fb-1ab8"
vary
Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=31536000
banglogo_small.png
www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/themes/wp-mason/static/images/site-logo/banglogo_small.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
75e752bf99299219069a5af90f61408be1ab85af71df9aea097bc70e9075c122
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz2 85 188 443
last-modified
Tue, 13 Dec 2022 21:43:24 GMT
server
nginx
etag
"6398f1fc-3b7b"
x-cache
HIT
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
15227
/
www.mercurynews.com/_static/ 		105 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJyVkd1SAyEMhV9INlr/9sbxWdglXVgDYRLQ2T69YO2FY+3YK5jkfMk5AB/ZzJwKpgKZ6hKSQkyL8YXAqmJRcEHLqWYiOx1iSMOqN3CGnYg5mj2LyXWioB5FIXObsB7Pq0BFK7Pv6PH2F5w9F077QATvmBwL5DCXKthLl+z+BskeNg0H/JEypJmqQ+1Ovp7jW9xamWnrfNOglP9Aggs2rS0tq9RUQsQrd12Ue+a3s18UqznF7rOsKNJm7ocRphrIAbF1KI16jS93T+Pzbrx9eNytn7f9zJs=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a41b806e591339f4357460a85a5c04b8f473f1c80ef3a1c3e3e14cf76f4471d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 20 Jun 2023 17:00:52 GMT
server
nginx
x-rq
yyz2 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
p.js
cdn.parsely.com/keys/mercurynews.com/ 		56 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.parsely.com/keys/mercurynews.com/p.js?ver=3.8.4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.101.60 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-101-60.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
cdd102d71e33401eb5ebadb19f1732edafa44df8800da6d33f29329c3ed9baef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Tue, 20 Jun 2023 13:52:05 GMT
content-encoding
gzip
via
1.1 a1546fc751225809c39b89ba9e8d715c.cloudfront.net (CloudFront)
last-modified
Thu, 09 Dec 2021 15:22:33 GMT
server
nginx
x-amz-cf-pop
JFK50-P5
age
21158
etag
W/"61b21f39-df44"
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400, public
x-amz-cf-id
p3Mpace_3qpLzAyRykiIshEyvewMf_mZrnpIgorODcD0_TvXCnEi4A==
expires
Wed, 21 Jun 2023 13:51:59 GMT
ads.js
www.mercurynews.com/wp-content/themes/wp-mason/static/js/ 		87 B
155 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/wp-mason/static/js/ads.js?ver=1.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz2 85 188 443
last-modified
Tue, 13 Dec 2022 21:43:24 GMT
server
nginx
etag
"6398f1fc-57"
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
accept-ranges
bytes
content-length
87
/
www.mercurynews.com/_static/ 		112 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/_static/??-eJydzkEKwjAQQNELmQ5KSXUhniUmaZuamQnOVPH2BnShIGLdfnjw4VqMZ9JICjpGjAJOJKqAqNPkYRLwjMjU+HGmU4OJmklW8IMrnG99ylmWoCPn4NnVkL+wWtAJ0wvMPLBJOBinev5ES56HRAKhR+OCQQ7yxmt73CzHsqFLCpH/kIW1Xj/hAfdru7Vd1+5sO90BHsOYcw==
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ba5a6577ef04a324ae8a4af890e1e26d341ac85bc5c49ad9be1678a61fcc3168
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz2 85 187 443
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
index.js
cdn.viafoura.net/entry/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.viafoura.net/entry/index.js?ver=2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:d200:8:2ae1:d740:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
47837a16e7b231cca39151ae124c3cb8ad0fb875a78fb39ef15725f9bd7a8870

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
7clcVwJ2uZ2xninCT38x2KDy2PpKpuXM
content-encoding
gzip
via
1.1 a5bdbdd1958d4d023b03427095a0a97a.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 19:44:14 GMT
x-amz-cf-pop
EWR53-C2
age
31
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 14 Jun 2023 17:25:59 GMT
server
AmazonS3
etag
W/"738c5427d8f7c25ccede619b95ab7ac5"
vary
Accept-Encoding
content-type
text/javascript
cache-control
public,max-age=600,s-max-age=60
x-amz-cf-id
LgDyR8zDH6Rf8UsGKuomLRmE3R6KvcRRHS59kd54k2e1Z5MsIeba2Q==
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		77 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js?ver=2.0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ba3ede4e1983d5ed1b23881890a64093ce7d891dadeaf500a943859eb76cc728
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26345
x-xss-protection
0
server
cafe
etag
118 / 19528 / 31075399 / config-hash: 16396063179614486054
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:37 GMT
dfm-viafoura.main.bundle.js
www.mercurynews.com/wp-content/plugins/dfm-viafoura-prototype/static/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/plugins/dfm-viafoura-prototype/static/dfm-viafoura.main.bundle.js?m=1678993769g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
820bbf383e1e212ca7bd59f29af6ab490ea9da86e84d61ed3322b9c77ac2fc6c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Thu, 16 Mar 2023 19:09:29 GMT
server
nginx
x-rq
yyz2 85 188 443
etag
W/"64136969-603c"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
e-202325.js
stats.wp.com/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202325.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz
date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
br
last-modified
Fri, 19 May 2023 02:58:21 GMT
server
nginx
etag
W/"6466e5cd-3508"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Wed, 12 Jun 2024 13:30:21 GMT
sharing.min.js
www.mercurynews.com/wp-content/mu-plugins/jetpack-12.2/_inc/build/sharedaddy/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/mu-plugins/jetpack-12.2/_inc/build/sharedaddy/sharing.min.js?m=1687280452g
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Tue, 20 Jun 2023 17:00:52 GMT
server
nginx
x-rq
yyz2 85 187 443
etag
W/"6491db44-2259"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
css
fonts.googleapis.com/ 		9 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a63284d0b07236a49f89dd197f9aa2ea595e314e750b5d42834fbda2f7cba411
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:42:47 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:44:36 GMT
ai.0.js
az416426.vo.msecnd.net/scripts/a/ 		94 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/wp-content/plugins/loader-wp/static/loader.min.js?ver=1.0.6.3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/79DC) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
1112
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (nya/79DC)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c079a44a-b01e-00b5-74ad-a369c5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Tue, 20 Jun 2023 20:14:37 GMT
polyfill.min.js
polyfill.io/v3/ 		101 B
669 B 		Script
General
Check archive.org
Download Go to
Full URL
https://polyfill.io/v3/polyfill.min.js?flags=gated&features=es5%2CCustomEvent%2CArray.from%2CArray.isArray%2CArray.prototype.filter%2CArray.prototype.find%2CArray.prototype.findIndex%2CArray.prototype.forEach%2CArray.prototype.indexOf%2CArray.prototype.keys%2CArray.prototype.lastIndexOf%2CArray.prototype.map%2CArray.prototype.reduce%2CDate.prototype.toISOString%2CDocumentFragment%2CDocumentFragment.prototype.append%2CDocumentFragment.prototype.prepend%2CElement%2CElement.prototype.after%2CElement.prototype.append%2CElement.prototype.before%2CElement.prototype.classList%2CElement.prototype.cloneNode%2CElement.prototype.closest%2CElement.prototype.dataset%2CElement.prototype.matches%2CElement.prototype.placeholder%2CElement.prototype.prepend%2CElement.prototype.remove%2CElement.prototype.replaceWith%2CElement.prototype.toggleAttribute%2CEvent%2CJSON%2CMap%2CNumber.parseInt%2CNumber.parseFloat%2CObject.assign%2CObject.create%2CObject.defineProperties%2CObject.defineProperty%2CObject.entries%2CObject.getOwnPropertyDescriptor%2CObject.getOwnPropertyNames%2CObject.is%2CObject.keys%2CObject.values%2CPromise%2CPromise.prototype.finally%2CSet%2CString.prototype.trim%2CXMLHttpRequest%2Cdocument.getElementsByClassName%2Cdocument.currentScript%2Cdocument.querySelector%2Cfetch%2CgetComputedStyle%2ClocalStorage%2CArray.prototype.some%2CDate.now%2CEvent.focusin%2CEventSource%2CFunction.prototype.bind%2CFunction.prototype.name%2CHTMLDocument%2CNodeList.prototype.forEach%2CNodeList.prototype.%40%40iterator%2CNode.prototype.contains%2CObject.getPrototypeOf%2CObject.setPrototypeOf%2CRegExp.prototype.flags%2CString.prototype.%40%40iterator%2CString.prototype.startsWith%2Cconsole%2Cconsole.debug%2Cconsole.error%2Cconsole.info%2Cconsole.log%2Cdocument%2Cdocument.head%2Cdocument.visibilityState%2Clocation.origin%2CrequestIdleCallback%2Cscreen.orientation%2CmatchMedia%2CURL
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::282 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubdomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 20 Jun 2023 19:44:37 GMT
age
1079061
detected-user-agent
Chrome/114.0.0
useragent_normaliser
chrome/114.0.0
server-timing
HIT, fastly;desc="Edge time";dur=1
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
113
referrer-policy
origin-when-cross-origin
last-modified
Wed, 03 May 2023 00:17:37 GMT
fastly_service_version
195
vary
User-Agent, Accept-Encoding
access-control-allow-methods
GET,HEAD,OPTIONS
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
normalized-user-agent
chrome/114.0.0
cache-control
public, s-maxage=31536000, max-age=604800, stale-while-revalidate=604800, stale-if-error=604800
accept-ranges
bytes
timing-allow-origin
*
gen_204
maps.googleapis.com/maps/api/mapsjs/ 		3 B
45 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true
Requested by
Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyDJUi9DGZnqI8YbyBueZXiiJjKzw9kGDlE&ver=6.2.2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
scaffolding on HTTPServer2 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
scaffolding on HTTPServer2
vary
Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23
x-xss-protection
0
session
session.mercurynews.com/api/ 		93 B
256 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.223.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-223-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:37 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 		16 B
699 B 		Script
General
Check archive.org
Download Go to
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json208
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.237.129.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-237-129-106.compute-1.amazonaws.com
Software
- /
Resource Hash
1436436e0c6c4ca6648aff74a2afe507a59e19cb76923ebd8c1b779778627450
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
36
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
6a3ad57b-9d82-4764-b0da-a1892940a4cb
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/6a3ad57b-9d82-4764-b0da-a1892940a4cb
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 		16 B
705 B 		Script
General
Check archive.org
Download Go to
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?&callback=bc_json209
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.237.129.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-237-129-106.compute-1.amazonaws.com
Software
- /
Resource Hash
22572ad7de28c9255a9657579b2d739869075cf10c7ebe6d76c559ac7e6d9cdb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
36
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
web-vitals.iife.js
unpkg.com/web-vitals@3.3.2/dist/
Redirect Chain
  • https://unpkg.com/web-vitals@3/dist/web-vitals.iife.js
  • https://unpkg.com/web-vitals@3.3.2/dist/web-vitals.iife.js
7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://unpkg.com/web-vitals@3.3.2/dist/web-vitals.iife.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
2606:4700::6810:7eaf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
27e29a5aebbbc2d82b6f7d9dbbf03ced7ecaf592adf68338a02aff332b3e7bd5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
688715
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01H2RMJY0R3RHJ9DJ5TSRCZ0FZ-yul
server
cloudflare
etag
W/"1b99-+0VwSXVmoLd0uGhBB2XoSfehK74"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7da681e92885715a-YUL

Redirect headers

date
Tue, 20 Jun 2023 19:44:37 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
fly-request-id
01H3D4XPTYC32E967626N2JGH7-yul
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
496
vary
Accept, Accept-Encoding
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
location
/web-vitals@3.3.2/dist/web-vitals.iife.js
cache-control
public, s-maxage=600, max-age=60
cf-ray
7da681e84f3a715a-YUL
loader.js
cdn.taboola.com/libtrc/medianewsgroup-network/ 		505 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/medianewsgroup-network/loader.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6020e58617f93875554a133f107b287c97dd12c8d8b6c0eb3f46f2d04a722be4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
GfG4Ne0IZxvonN2uPJ49lY63yw5v1noD
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:37 GMT
x-amz-request-id
YW1STKWSKF041F9Y
age
103
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
FAILED
content-length
53269
x-amz-id-2
FG16ZoAzws9T1H1CjTtlHu1tsK9e6mRRya13RxVkrTil7nP+Wiac8ZnLQOO6pUUZmIeRZmbN830=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 09:48:47 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290277.208242,VS0,VE0
etag
"ab1d787c5482a21bc61f4a1ca8a5e5ec"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
81
access-control-allow-origin
*
cache-control
private,max-age=14401
accept-ranges
bytes
x-cache-hits
419
gtm.js
www.googletagmanager.com/ 		499 KB
117 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TLFP4R
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
91a0770b8a81a169e198ee7d94ffd5e975ca890b1ae75240ae5dae2817a180ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
119374
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:44:37 GMT
truncated
/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141

Request headers

Referer
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
font/truetype
SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
fonts.gstatic.com/s/droidsans/v18/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidsans/v18/SlGWmQWMvZQIdix7AFxXmMh3eDs1Zw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 18 Jun 2023 02:20:04 GMT
x-content-type-options
nosniff
age
235473
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
22376
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:25:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 17 Jun 2024 02:20:04 GMT
bootstrap-icons.woff2
cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/ 		88 KB
89 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/fonts/bootstrap-icons.woff2?856008caa5eb66df68595e734e59580d
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://cdn.jsdelivr.net/npm/bootstrap-icons@1.5.0/font/bootstrap-icons.min.css?ver=5.2.0
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:44:37 GMT
x-content-type-options
nosniff
age
8405087
x-jsd-version
1.5.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
90528
x-served-by
cache-fra-eddf8230031-FRA, cache-yul12829-YUL
x-jsd-version-type
version
etag
W/"161a0-RkmHeGigBozlCxBdDSojXoAQyY8"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
fonts.gstatic.com/s/droidsans/v18/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidsans/v18/SlGVmQWMvZQIdix7AFxXkHNSbQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 10:39:34 GMT
x-content-type-options
nosniff
age
291903
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21224
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:04:18 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 10:39:34 GMT
tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
fonts.gstatic.com/s/droidserif/v19/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidserif/v19/tDbV2oqRg1oM3QBjjcaDkOJGiRD7OwE.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4fa898d9bdc34304905c4b165e561c8dc3fe452b0bdd7259140e1aa530a42136
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 14:00:34 GMT
x-content-type-options
nosniff
age
279843
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
25980
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 18:47:46 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 14:00:34 GMT
tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
fonts.gstatic.com/s/droidserif/v19/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidserif/v19/tDbI2oqRg1oM3QBjjcaDkOr9rAU.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans%3A400%2C700%7CDroid+Serif%3A400%2C400i%2C700%2C700i%7CArvo%3A400%2C400i%2C700%2C700i&ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aee4051a20e975b9bb6fdc20984a091eb1f55c35ea87abe441db4cdbe8c116d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 02:03:58 GMT
x-content-type-options
nosniff
age
582039
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
22476
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:19:08 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 13 Jun 2024 02:03:58 GMT
session
session.mercurynews.com/api/ 		93 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.223.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-223-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:37 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
/
p1.parsely.com/plogger/ 		43 B
258 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p1.parsely.com/plogger/?rand=1687290277402&plid=71546046&idsite=mercurynews.com&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&sref=&sts=1687290277395&slts=0&title=Meghan+Markle+earned+more+than+The+Weeknd+for+%2712+hours+work%27%3A+Spotify&date=Tue+Jun+20+2023+19%3A44%3A37+GMT%2B0000+(GMT)&action=pageview&pvid=16610956&u=pid%3D2ba5b962c55af6057bf954d95d567cd1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.205.167.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-205-167-202.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:37 GMT
Cache-Control
no-cache
Last-Modified
Tuesday, 20-Jun-2023 19:44:37 GMT
Server
nginx
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Britain_Royals_03732-1.jpg
www.mercurynews.com/wp-content/uploads/2023/03/ 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/uploads/2023/03/Britain_Royals_03732-1.jpg?w=862
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d563298c3ede28f01a71384931c619cda9aadce1007034f284f3c0f0316303f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz2 87 131 443
last-modified
Tue, 20 Jun 2023 19:44:37 GMT
server
nginx
etag
"e20826dc7fac5ed1"
vary
Accept
x-cache
MISS
content-type
image/webp
cache-control
max-age=31536000
accept-ranges
bytes
content-length
31734
common.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/ 		42 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/common.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
cbccc935557398179deeef044a5ab2353e97ca4961f313793c8ba03964c43e93
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz2 85 188 443
etag
W/"648a24b4-a619"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
common-async.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/ 		64 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/common-async.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
a832c721859e66024092445300431d52b19ce96eb53588ad13954e78be2a8580
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz2 85 188 443
etag
W/"648a24b4-10029"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
boldcoastal-async.chunk.min.js
www.mercurynews.com/wp-content/themes/assets/static/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.mercurynews.com/wp-content/themes/assets/static/js/boldcoastal-async.chunk.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
4d04e98fa76e2cdba4b0b45b0b206b13de39ff72f6371b7d97ed515e21646722
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000;includeSubdomains
last-modified
Wed, 14 Jun 2023 20:36:04 GMT
server
nginx
x-rq
yyz2 85 187 443
etag
W/"648a24b4-c75"
vary
Accept-Encoding
x-cache
HIT
content-type
application/javascript
cache-control
max-age=31536000
session
session.mercurynews.com/api/ 		93 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.223.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-223-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:37 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
mercurynews.com
pubcast-files.remixd.com/player-configs/ 		8 KB
9 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pubcast-files.remixd.com/player-configs/mercurynews.com
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
f9d24c71e954513157a412b5339112437e013cf99070b258e445101f16747500

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:55:22 GMT
age
2955
x-guploader-uploadid
ADPycdsRqsaCLkqcvoKLLz2isyPYfnn-fV86CMJTEQStQtPWRzesf196Xp1qNk9dRAHzNuz462SzgVBx8hB24Zlb_omWAjp-RNQd
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8352
last-modified
Thu, 15 Jun 2023 11:20:10 GMT
server
UploadServer
etag
"50de11d656548e115c3b3202413c53f2"
x-goog-generation
1686828010228687
x-goog-hash
crc32c=wwSIAQ==, md5=UN4R1lZUjhFcOzICQTxT8g==
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=3600
x-goog-meta-cache-control
public, no-cache, must-revalidate
x-goog-stored-content-length
8352
accept-ranges
bytes
content-type
application/json
expires
Tue, 20 Jun 2023 19:55:22 GMT
impl.20230620-6-RELEASE.js
cdn.taboola.com/libtrc/ 		771 KB
161 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/impl.20230620-6-RELEASE.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3-br /
Resource Hash
3d7a16ff1ffd8d8507acd6f1ac3f27609a4e979b0a8e37474d3e0ba43e20fe3c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
dW870OqV0Fjzx1sEnMaMAQCgQ8fcUdYZ
content-encoding
br
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:37 GMT
x-amz-request-id
Z75T968SMGRC8X71
age
8430
x-amz-server-side-encryption
AES256
x-cache
HIT
content-length
163991
x-amz-id-2
5tth4PkSPD9yJMmcFTFJ0cZmQp9J1M9z19lezwRVj9y/gJOfLZnyv+O1FIVeJxptr9EWsY/80cA=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 09:24:07 GMT
server
AmazonS3-br
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290278.545218,VS0,VE0
etag
"fd6dea8d7a047382b08a9c2a433a2c8f"
vary
Accept-Encoding
content-type
application/javascript
abp
43
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
17587
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		77 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a208ff8707bb3e24896c1ea292daa9faabc093e8ce9f6363de8b0ef306a52c1e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26344
x-xss-protection
0
server
cafe
etag
678 / 19528 / m202306140101 / config-hash: 16396063179614486054
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:37 GMT
apstag.js
c.amazon-adsystem.com/aax2/ 		236 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-107-138.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:16:24 GMT
content-encoding
gzip
via
1.1 613faec4b883bfe2ebdd8a74d5006f4c.cloudfront.net (CloudFront), 1.1 1ecc1c31dec508980f534756c9974928.cloudfront.net (CloudFront)
last-modified
Thu, 15 Jun 2023 18:14:55 GMT
server
AmazonS3
x-amz-cf-pop
IAD89-C3, JFK50-P3
age
1694
x-amz-server-side-encryption
AES256
etag
W/"7c6a36eb4b73f6b7cf4a63a33418a2c9"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=3600
x-amz-cf-id
EjJf_o0eahXoJ5xmOYX5BMqgUQ_gBtrqquuvDW6uYOeSy2r-Ce3glA==
207
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		160 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A37%2B00%3A00&ts=1687290277576
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
034d5dcc8f23fff30ab2b7836559516e103b3c54635705c4f037c92722b11753
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
158
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
qxUOLJqqkL-b9t7V6FAsTvgDL5_lC4DkhOUseMXV2gzeKKQSNMUv_A==
expires
Thu, 01 Jan 1970 00:00:00 GMT
207
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		143 KB
22 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A37%2B00%3A00&ts=1687290277581
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
7d3e9f675f392ffb980a886b1a7dc458a0c033fa16b48cc12cd51fe6d16ee68b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
21318
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
PG_IwpA0l-EWwl9WO1o4wUMhFtJAjBu1p4USdChZSqmzKR3WPkxWhA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
6b4a4be9-f966-437b-aa06-a38332e86ac1
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/6b4a4be9-f966-437b-aa06-a38332e86ac1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
08bc2d6e-03fd-47ec-9476-e0b9e0b8f89b
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/08bc2d6e-03fd-47ec-9476-e0b9e0b8f89b
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
loader-config.json
loader-cdn.azureedge.net/prod/dfm/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://loader-cdn.azureedge.net/prod/dfm/loader-config.json?_=1687290276841
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C73) /
Resource Hash
5ce0cb7f558c1aca9c6e94c7d85d76db859218132923c039b7ef7b38a29f8dfd

Request headers

Accept
*/*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
content-md5
1iDtMuqZEAqLGRPxG2wEug==
age
43088
x-cache
HIT
content-length
1300
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:44:01 GMT
server
ECAcc (nya/1C73)
etag
0x8DB6B18C9F2D8E6
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
7b9ac8bb-001e-0088-404b-a312b7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
/
cmp.osano.com/ Frame 9668 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:aa00:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45303
content-encoding
br
content-type
text/html
date
Tue, 20 Jun 2023 07:09:35 GMT
etag
W/"287b497c992487af362d33204f87d28f"
last-modified
Thu, 21 Oct 2021 22:01:08 GMT
referrer-policy
strict-origin-when-cross-origin
server
AmazonS3
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding Origin
via
1.1 9750f5ee94b45ad0faba87b3fac2aad6.cloudfront.net (CloudFront)
x-amz-cf-id
RFXdhIMFX6wyg8s4lhiigTeOFQ3s9JA7EZr4FWiKNUm92vgdkdhbRg==
x-amz-cf-pop
JFK50-P5
x-amz-version-id
xT1PkIFehetvNf5lINcU02FbT3u47kBr
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-xss-protection
1; mode=block
v2
api.viafoura.co/v2/www.mercurynews.com/bootstrap/ 		7 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.viafoura.co/v2/www.mercurynews.com/bootstrap/v2
Requested by
Host: cdn.viafoura.net
URL: https://cdn.viafoura.net/entry/index.js?ver=2.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:44f0:4847:757a:9f73:587:7107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e8cb92b60579b9491a0dc1a4aafc9bee18224b80645722171963e75a0577ae4d

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-instance-id
i-0dc51adcd85703895
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS, PUT, DELETE, PATCH, HEAD
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
max-age=0
access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
expires
Tue, 20 Jun 2023 19:44:37 GMT
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/ 		408 KB
126 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js?cb=31075399
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5b70d8eb19ca32d244e29e759e816c343be893232978532c9d5943f838e60e0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 08:50:31 GMT
content-encoding
br
x-content-type-options
nosniff
age
39246
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
129045
x-xss-protection
0
server
cafe
etag
16806126990728334555
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Wed, 19 Jun 2024 08:50:31 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		616 B
320 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.mercurynews.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js?ver=2.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ac888a811086e5e08352c3dc0d0b704206641c37f78b1932c3ca956367aed497
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:37 GMT
g.gif
pixel.wp.com/ 		50 B
93 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&blog=116372247&post=9968021&tz=-7&srv=www.mercurynews.com&hp=vip&j=1%3A12.2.1&host=www.mercurynews.com&ref=&fcp=740&rand=0.976430473342067
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:37 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
2615.svg
s.w.org/images/core/emoji/14.0.0/svg/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/14.0.0/svg/2615.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
8b8afd8f60833ca51907899d4a3279cdfd355282858ba8a73cd1034d2a1e31ff
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz 2
date
Tue, 20 Jun 2023 19:44:37 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 03:50:38 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
accept-ranges
bytes
content-length
1294
expires
Thu, 31 Dec 2037 23:55:55 GMT
1f451.svg
s.w.org/images/core/emoji/14.0.0/svg/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/14.0.0/svg/1f451.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
3916390d4395ed16641c0e23d5e5a1bef9de6ce71b02c3941c0ee6f2d899c806
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz 2
date
Tue, 20 Jun 2023 19:44:37 GMT
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 03:53:43 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
accept-ranges
bytes
content-length
1311
expires
Thu, 31 Dec 2037 23:55:55 GMT
1f393.svg
s.w.org/images/core/emoji/14.0.0/svg/ 		958 B
463 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.w.org/images/core/emoji/14.0.0/svg/1f393.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.48 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
s.w.org
Software
nginx /
Resource Hash
14e71be3ff5aa2e7773210530b6f25ac38218c1833c4efec611f8c89e650db52
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-nc
HIT yyz 2
date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Tue, 12 Apr 2022 03:47:50 GMT
server
nginx
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
access-control-allow-origin
*
access-control-allow-methods
GET, HEAD
cache-control
max-age=315360000
expires
Thu, 31 Dec 2037 23:55:55 GMT
truncated
/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
14f3a2330f6d02bcd5407635a03c7ab8ed1aa494914c05881137c5e86ae20acf

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
img/png
truncated
/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f6d8894bccb6968f9c55a23894a63a454f3425a7a4c19251ba01d9e3493084a0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
img/png
state-ny.png
www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.mercurynews.com/wp-content/plugins/bloom-for-publishers/images/state-ny.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.66.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f9c4ffcfab2c93ba07bd2d4a2dd53a1d23faace457ade18c52c3f4ea67b8ea68
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;includeSubdomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/_static/??-eJyNztEKwjAMBdAfsstE2PRB/JYt62ywTUuT4u+7tT4JA98uCSe58E4GI6tlheTLk1hg9jEGs8ZsUpk9ibNZIEVRQGmh28IJ/qVip4yu4hYP+bIGo7mIGuKFcNK4c52UsPLfXReID4+57dfLMtQmzX9HrRzu8hHu52Hsb8N47S8fV1JlGg==
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
strict-transport-security
max-age=31536000;includeSubdomains
x-rq
yyz2 85 188 443
last-modified
Tue, 13 Dec 2022 21:43:23 GMT
server
nginx
etag
"6398f1fb-26da"
x-cache
HIT
content-type
image/png
cache-control
max-age=31536000
accept-ranges
bytes
content-length
9946
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 13 Jun 2023 22:34:53 GMT
x-content-type-options
nosniff
age
594584
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48412
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 12 Jun 2024 22:34:53 GMT
style
accounts.google.com/gsi/ 		533 B
608 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/style
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::200d Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-Wtqc0d71ZzsMkRinqTj4bA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-Wtqc0d71ZzsMkRinqTj4bA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
text/css; charset=utf-8
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Tue, 20 Jun 2023 19:44:37 GMT
status
accounts.google.com/gsi/ 		40 B
529 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/status?client_id=682906792919-57292pukl717kpesjb0r4cnr5342j506.apps.googleusercontent.com&as=COP8n%2FIZZoH27LzphzVTFg
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/gsi/client?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::200d Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a7d737341853b8013d3c36a41dda336005b1d6acdde6bf24977f7c4d1b229828
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-FElak98dg1fKjhHXBKSxQQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, script-src 'report-sample' 'nonce-FElak98dg1fKjhHXBKSxQQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
x-content-type-options
nosniff
content-encoding
gzip
content-disposition
attachment; filename="json.txt"; filename*=UTF-8''json.txt
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
pragma
no-cache
server
ESF
x-frame-options
SAMEORIGIN
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Mon, 01 Jan 1990 00:00:00 GMT
session
session.mercurynews.com/api/ 		93 B
255 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://session.mercurynews.com/api/session
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/_static/??-eJyl0MEKwjAMBuAXsg3C6PQgXn2NdgslpYnDpLjHtx4EdxLcKeTnz3cIPBc33cVQDJbaMokCS3YzZdKWFNSi0bTJPEcSn5rMFX3RA/xj9APB1fYyvUxWkfvUvVajW3wDjx+QkqHbLClK/pDlK/PcH1X0ypdjOIVxHM5hKC/Yl4tq
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.40.223.220 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-40-223-220.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1

Request headers

Accept
application/json, text/plain, */*
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:37 GMT
access-control-allow-credentials
true
content-length
93
vary
Origin
content-type
application/json; charset=utf-8
e527e635-c2f1-414d-9909-82cb430e2137
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/e527e635-c2f1-414d-9909-82cb430e2137
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
c67463e1-5e4e-492e-877e-d555460c3bf5
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/c67463e1-5e4e-492e-877e-d555460c3bf5
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
quant.js
secure.quantserve.com/ 		22 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.quantserve.com/quant.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:4cb8:1820:80ca:50f7 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
gzip
etag
"sLp6xTjO7svFVaOemhLWUQ=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
accept-ranges
bytes
expires
Tue, 27 Jun 2023 19:44:37 GMT
asyncPixelSync
pixel.sitescout.com/dmp/ Frame FD3B
Redirect Chain
  • https://pixel.sitescout.com/dmp/asyncPixelSync
  • https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
207.198.113.230 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
A /
Resource Hash
a996e7499ac6bccf92e156e87689af5666069dc01bf2b6efd40063f014702c20

Request headers

Referer
https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=0,no-cache,no-store
content-length
1162
content-type
text/html;charset=UTF-8
date
Tue, 20 Jun 2023 19:44:37 GMT
expires
Tue, 11 Oct 1977 12:34:56 GMT
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
server
A

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:37 GMT
location
https://pixel.sitescout.com/dmp/asyncPixelSync?cookieQ=1
server
A
config.js
cdn.confiant-integrations.net/3IyQ81Wnn-d6bieQLuWeDuN4PWM/gpt_and_prebid/ 		106 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.confiant-integrations.net/3IyQ81Wnn-d6bieQLuWeDuN4PWM/gpt_and_prebid/config.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:220a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
781b3e8726a42112cd2192dd9654cf6eaf79525c7780e3c4fd8469125cc99563

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 20 Jun 2023 18:45:48 GMT
server
cloudflare
x-amz-request-id
C5AWVG1YX67TQFT2
age
878
etag
W/"73b5877229bc86a7af5b3f53f5edaef7"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=900, stale-while-revalidate=3600
cf-ray
7da681ec7c254bbe-YUL
alt-svc
h3=":443"; ma=86400
x-amz-id-2
8bqhK+WFXQ68hnV/bda6rsQvunsIbJsXr2OjEV50ldcQ0ERBsKwsl4UQrtp9sqR8OHa5V6ZCjb1+ULkLpNCsEg==
launchpad-liveramp.js
launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/ 		9 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://launchpad-wrapper.privacymanager.io/70bb23e5-a2a7-414e-b709-7066b1333c83/launchpad-liveramp.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.93.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-44.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
21b580c0e786d0ff2b8ef69d2808f19c17e9106f4effdf1771475ac870c81ea1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
WVJHJlCeP1N2IpvGFdgw87IN7xdjr1fa
content-encoding
gzip
via
1.1 39947baba82573c8d139cba81c505476.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 18:40:38 GMT
x-amz-cf-pop
JFK50-P8
age
3840
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-disposition
attachment; filename="launchpad-liveramp.js"
last-modified
Mon, 18 Jul 2022 17:01:39 GMT
server
AmazonS3
etag
W/"456ed7d264d33c8630706e5b37966010"
vary
Accept-Encoding
content-type
text/javascript
x-amz-cf-id
TYOt7aJfTGKiIol1e28WyFjgHAlVeIE8Np5MXje2QbS_IW1O_fM1Qw==
js
www.googletagmanager.com/gtag/ 		139 KB
53 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-11039244145
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
012a69ca45064c59cd497a10a916a6100805aa44c6f9a4297deb131d6de49ed8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
54613
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:44:37 GMT
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=6035443&ns__t=1687290277738&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1687290277738&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%...
0
225 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6035443&ns__t=1687290277738&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
13.35.93.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-41.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
via
1.1 67d3f8867c3d6540e7495f9026c9c57a.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P8
x-amz-cf-id
s4bnetTm3dGd5CQ1CLZhTAf55XocO7SpBkJEGCvlBFAO3EdpJInEgg==
x-cache
Miss from cloudfront

Redirect headers

date
Tue, 20 Jun 2023 19:44:37 GMT
via
1.1 67d3f8867c3d6540e7495f9026c9c57a.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P8
x-cache
Miss from cloudfront
location
/b2?c1=2&c2=6035443&ns__t=1687290277738&ns_c=UTF-8&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c9=
content-length
0
x-amz-cf-id
wpGlHhPrgHfN1Oj__zH-BC4qHFC7bWt0NpVq_Ody3F-dCqVLpPT4YA==
d66dfa6e9938b7de
pixel.sitescout.com/iap/
Redirect Chain
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de
  • https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
0
341 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
207.198.113.230 Herndon, United States, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:37 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
expires
Tue, 11 Oct 1977 12:34:56 GMT

Redirect headers

location
https://pixel.sitescout.com/iap/d66dfa6e9938b7de?cookieQ=1
date
Tue, 20 Jun 2023 19:44:37 GMT
server
AC1.1
content-length
0
vitals
www.foo.software/api/ 		0
96 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.foo.software/api/vitals
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
137.184.240.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.25.0 / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:37 GMT
server
nginx/1.25.0
x-powered-by
Express
cbd33565-ba55-4387-9794-e5201d9cc7d2
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/cbd33565-ba55-4387-9794-e5201d9cc7d2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
2380a01c-607f-406e-ab1a-247707fa78df
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/2380a01c-607f-406e-ab1a-247707fa78df
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
71495bd3-de96-4f92-bbbd-ba97017eed8a
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/71495bd3-de96-4f92-bbbd-ba97017eed8a
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
ceaac314-db90-4723-9ad4-f91c392b442d
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/ceaac314-db90-4723-9ad4-f91c392b442d
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
d8d9c077aeb2f07c7fe3017ecf6d44ca
a869.mercurynews.com/plugin/plugin/ 		233 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/plugin/plugin/d8d9c077aeb2f07c7fe3017ecf6d44ca
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
d623d4148afe3958f8cf929fccf8a2661b93a30e7f0550fd26f478dca78ab492
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 13 Jun 2023 20:26:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
602294
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
56480
x-xss-protection
1; mode=block
last-modified
Mon, 12 Jun 2023 20:26:23 GMT
server
-
etag
d8d9c077aeb2f07c7fe3017ecf6d44ca
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
u10lYIvnXZN4GDAeMsdXk0s3h0AOiGd97k2rSx_F_TvE1jiwsxRJ0Q==
expires
Wed, 12 Jun 2024 20:26:23 GMT
standard-player.html
tags.remixd.com/player/v5/players/ 		129 KB
30 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://tags.remixd.com/player/v5/players/standard-player.html
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.63 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-63.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7f5d73c848836745a93ff7aa540a8f83f9899e3668628f42e9ba0cc6ef5e0b32

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
via
1.1 94ac78512342d473815908b66b16cd7c.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR50-C1
x-cache
Hit from cloudfront
content-length
29730
last-modified
Tue, 21 Jun 2022 15:31:59 GMT
server
AmazonS3
etag
"9a2e807a291cbaccaab15c40f0629813"
access-control-max-age
60
access-control-allow-methods
GET, HEAD
content-type
text/html
access-control-allow-origin
*
cache-control
public,max-age=1800
vary
Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges
bytes
x-amz-cf-id
Bia7zRKHL3RMLBlEPqhBB1vwzvNxymB0BKBrEyr9DO8r-GksRV4e1g==
ingest
i.viafoura.co/v3/www.mercurynews.com/ 		67 B
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.viafoura.co/v3/www.mercurynews.com/ingest?t=%7B%22view%22%3A%7B%22domain%22%3A%22www.mercurynews.com%22%2C%22siteUuid%22%3A%2200000000-0000-4000-8000-c86bf0725f23%22%2C%22pageViews%22%3A1%2C%22outgoing%22%3A10%2C%22sessionStart%22%3A1687290278%2C%22isRecirculation%22%3Afalse%2C%22uniqueId%22%3A%22286a83b5-7487-4649-a7c3-a322672ecbc1%22%2C%22firstVisit%22%3A1687290278%2C%22previousVisit%22%3A1687290278%2C%22currentVisit%22%3A1687290278%2C%22visitCount%22%3A1%2C%22referrerStart%22%3A1687290278%2C%22refVisitCount%22%3A1%2C%22ref%22%3A%7B%22medium%22%3A%22direct%22%2C%22source%22%3A%22%22%2C%22sharer_uuid%22%3A%22%22%2C%22terms%22%3A%22%22%7D%7D%2C%22meta%22%3A%7B%22domain%22%3A%22www.mercurynews.com%22%2C%22site%22%3A%2200000000-0000-4000-8000-c86bf0725f23%22%2C%22section%22%3A%2200000000-0000-4000-8000-c86bf0725f23%22%2C%22pageImage%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1.jpg%3Fw%3D1024%26h%3D683%22%2C%22ref%22%3A%7B%7D%2C%22vf%22%3Afalse%2C%22url%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22path%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22title%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%E2%80%99%20ex-Spotify%20exec%20tells%20BBC%22%2C%22privilege%22%3A%22guest%22%2C%22page_type%22%3A%22article%22%2C%22page_description%22%3A%22Even%20though%20Markle%20only%20produced%2012%20hours%20of%20podcast%20content%20in%202%201%2F2%20years%2C%20she%20possibly%20earned%20far%20more%20money%20than%20The%20Wknd%20for%20%E2%80%98Blinding%20Lights%2C%E2%80%99%20the%20most%20streamed%20song%20in%20Spotify%26%238%E2%80%A6%22%2C%22topics%22%3A%5B%5D%2C%22amp%22%3Afalse%2C%22thirdparty_enabled%22%3Afalse%2C%22container_id%22%3A%229968021%22%7D%2C%22ua%22%3A%7B%22nl%22%3A%22en-US%22%2C%22nu%22%3A%22Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36%22%2C%22sr%22%3A%221600x1200%22%2C%22sd%22%3A24%2C%22vp%22%3A%221600x1200%22%2C%22dt%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify%22%2C%22de%22%3A%22UTF-8%22%2C%22dl%22%3A%22en-US%22%7D%2C%22rq%22%3A%22d8b87711-433a-468c-85ea-7585d05800df%22%2C%22w%22%3A%5B%22vf-conversations%22%2C%22vf-tray%22%2C%22vf-content-recirculation%22%5D%2C%22event_type%22%3A%22analytics.view_lite%22%7D
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.2.47.221 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-2-47-221.compute-1.amazonaws.com
Software
/
Resource Hash
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:44:38 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
67
expires
Fri, 01 Jan 1990 00:00:00 GMT
load.js
pm-widget.taboola.com/medianewsgroup-network/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pm-widget.taboola.com/medianewsgroup-network/load.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
986ccecb5ddec6d653cdb03022cbb35af07301b752cad8ac1d6c7aa66a11e661

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
iVYX3NWtVvLgaZWbuxTvffzyb1PlHiYS
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Tue, 20 Jun 2023 19:44:37 GMT
x-amz-request-id
X6YEKWD34AR5NGS6
age
231
x-cache
HIT, HIT
content-length
1078
x-amz-id-2
7b9FNLhXy4GnVVy+nbp9g24EBAwM15yM/81aPsFz3MTVqszOmj8qKD5O2ua7ukyyGC3/SGH+NaM=
x-served-by
cache-bur-kbur8200062-BUR, cache-yul12823-YUL
last-modified
Tue, 30 May 2023 04:23:23 GMT
server
AmazonS3
x-timer
S1687290278.977670,VS0,VE0
etag
"a9928842e0a03e30273550ed905b9329"
vary
Accept-Encoding,,
content-type
application/javascript; charset=utf-8
cache-control
max-age=300
accept-ranges
bytes
x-cache-hits
27535, 3
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ 		6 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-107-138.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
Zm_tZQQ808JKRizBfXGgSN2OWn8Z6JUU
content-encoding
gzip
via
1.1 153c5cd2b3e635613d0a2fa0f107993a.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 12:05:04 GMT
x-amz-cf-pop
JFK50-P3
age
27575
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 26 May 2023 01:35:48 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
vary
Accept-Encoding,Origin
x-amz-cf-id
dP6K-qtfvzsp-VPP1tmD2FKS3Fd_UWoJ6JMug7PhMTHMUn790Cl9dQ==
sync
gum.criteo.com/ 		46 B
288 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?c=72&r=2&j=TRC.getRTUS&us_privacy=1---&gdpr=0&gdpr_consent=&gdpr_pd=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:37 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
392968
expires
60
fastlane.json
fastlane.rubiconproject.com/a/api/ 		524 B
861 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768250&size_id=43&alt_size_ids=44&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=cf64d402-ae10-420c-b510-96067bcb927f&l_pb_bid_id=2039580c8aa6c2&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=cf64d402-ae10-420c-b510-96067bcb927f&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%231&slots=1&rand=0.7646600672464083
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
f0d0f2235b17a9ecadc8263a94826ce5c05e8c38e766a082cc7f730bf4790ad2

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
524
expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		528 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768258&size_id=2&alt_size_ids=55%2C57&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=7f2270e1-1c16-420d-a0c5-02011d9d4cdf&l_pb_bid_id=34e4d584aac9a2&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=7f2270e1-1c16-420d-a0c5-02011d9d4cdf&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%231&slots=1&rand=0.8859553547457408
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
e8a97225f904b851e6ace09e5a8446be3a66378b701e3f9556761092e275d721

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
528
expires
Wed, 17 Sep 1975 21:32:10 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ 		0
0
auction
tlx.3lift.com/header/ 		19 B
578 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tlx.3lift.com/header/auction?lib=prebid&v=7.46.0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tmax=2000&us_privacy=1---
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.172.46.145 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-46-145.compute-1.amazonaws.com
Software
/
Resource Hash
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
accept-ch
user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform,sec-ch-dpr
x-auction-status
12, 12, 12
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
content-length
19
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
prebid
ads.yieldmo.com/exchange/ 		0
228 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ads.yieldmo.com/exchange/prebid?pbav=7.46.0&p=%5B%7B%22placement_id%22%3A%22htlad-1-gpt%22%2C%22callback_id%22%3A%22106f67551ee5a0b%22%2C%22sizes%22%3A%5B%5B300%2C50%5D%2C%5B320%2C50%5D%5D%2C%22ym_placement_id%22%3A%223263962355775513258%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%231%22%2C%22tid%22%3A%22cf64d402-ae10-420c-b510-96067bcb927f%22%2C%22auctionId%22%3A%22db557c2a-bcad-4282-80d4-986b300fe83f%22%7D%2C%7B%22placement_id%22%3A%22htlad-3-gpt%22%2C%22callback_id%22%3A%22119e33fd716e23a%22%2C%22sizes%22%3A%5B%5B728%2C90%5D%2C%5B970%2C90%5D%2C%5B970%2C250%5D%5D%2C%22ym_placement_id%22%3A%223263962357730058934%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%231%22%2C%22tid%22%3A%227f2270e1-1c16-420d-a0c5-02011d9d4cdf%22%2C%22auctionId%22%3A%22db557c2a-bcad-4282-80d4-986b300fe83f%22%7D%2C%7B%22placement_id%22%3A%22htlad-6-gpt%22%2C%22callback_id%22%3A%2212df07965ca68d7%22%2C%22sizes%22%3A%5B%5B300%2C250%5D%2C%5B300%2C600%5D%2C%5B300%2C1050%5D%2C%5B160%2C600%5D%5D%2C%22ym_placement_id%22%3A%223263962352562676374%22%2C%22gpid%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231%22%2C%22tid%22%3A%22ad84d507-3304-4eb1-b802-823505a908ec%22%2C%22auctionId%22%3A%22db557c2a-bcad-4282-80d4-986b300fe83f%22%7D%5D&page_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bust=1687290278084&dnt=false&description=Meghan%20Markle%20only%20produced%2012%20hours%20of%20podcast%20content%20in%202%C2%BD%20years%2C%20yet%20possibly%20earned%20more%20than%20The%20Weeknd%20for%20his%20huge%20hit%20%27Blinding%20Lights.%27&userConsent=%7B%22gdprApplies%22%3A%22%22%2C%22cmp%22%3A%22%22%2C%22gpp%22%3A%22%22%2C%22gpp_sid%22%3A%22%22%7D&us_privacy=1---&pr=&scrd=1&title=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&w=1600&h=1200
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.218.133.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-133-69.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
access-control-allow-credentials
true
x-robots-tag
none,NOINDEX,NOFOLLOW
access-control-allow-methods
POST, GET, OPTIONS
access-control-request-headers
Cache-Control, Pragma
cdb
bidder.criteo.com/ 		0
198 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=35&wv=7.46.0&cb=44518833433&lsavail=1
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:37 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
prebid
ib.adnxs.com/ut/v3/ 		378 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4648be38834a1fbce25220f7f42ba34c7f01b7638c059dadae417050066e69c0
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:38 GMT
AN-X-Request-Uuid
12248456-9e03-408d-b80c-00d34cca9f55
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
378
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
translator
hbopenbid.pubmatic.com/ 		0
119 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:38 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
pbjs
htlb.casalemedia.com/openrtb/ 		37 B
545 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://htlb.casalemedia.com/openrtb/pbjs?s=945271
Requested by
Host: htlbid.com
URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
59d90c97a6f90abcccd6b7f05747b707726f5149e07630a040cb93f1af7183a2

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y6AW0zU0QzFzlcJX0qNlSS4pariVOp7jPoDfsgF6q1sUPqO39Xa7SF7fE2siJTVg4CsW9dGoorDDHSITaOPU9JFCrY3chnRQtgcgyGdGMbMbnOBx8hF6ll5%2F4CPwJoqA8A8VKGix"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache
access-control-allow-credentials
true
cf-ray
7da681ee6e89542b-YYZ
alt-svc
h3=":443"; ma=86400
content-length
37
expires
0
config
c.amazon-adsystem.com/cdn/prod/ 		320 B
679 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=3391&u=https%3A%2F%2Fwww.mercurynews.com
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.107.138 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-107-138.jfk50.r.cloudfront.net
Software
Server /
Resource Hash
7bd8b3e8c5d0f5c0a1c5ed3b69c09e4ae5edb40519ad8a1882b007ac3bf91901

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:13:51 GMT
via
1.1 1ecc1c31dec508980f534756c9974928.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
JFK50-P3
age
5446
x-cache
Hit from cloudfront
content-type
application/json;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
content-length
320
x-amz-cf-id
U2Wp-S_ovABo2PlXkBoqVOzkPMeUbo8YjE0atEoyI2jHD08poFM1ng==
bid
aax.amazon-adsystem.com/e/dtb/ 		244 B
689 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://aax.amazon-adsystem.com/e/dtb/bid?src=3391&u=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&pid=aLlW2Fw6sbJJD&cb=0&ws=1600x1200&v=23.612.1758&t=2000&slots=%5B%7B%22sd%22%3A%22htlad-1-gpt%22%2C%22s%22%3A%5B%22320x50%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fsponsorship_1%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-3-gpt%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Ftop_leaderboard%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%2C%7B%22sd%22%3A%22htlad-6-gpt%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%2C%22160x600%22%5D%2C%22sn%22%3A%22%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%22%2C%22fc%22%3A%22USD%22%2C%22fp%22%3A10%7D%5D&gpp=DBACOe~~~&gpp_sid=%5B5%5D&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.126.121 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-126-121.jfk50.r.cloudfront.net
Software
Server /
Resource Hash
f8e60fa507399273a3862f6ca5b4daf3df1b225801d641c564a10336e84773e5
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
strict-transport-security
max-age=47474747; includeSubDomains; preload
via
1.1 0afec277ba3e75e96fa6b4c76d8e130c.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
JFK50-P4
x-amz-rid
2QTNZBA94SRB62HMT7CW
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
access-control-allow-credentials
true
timing-allow-origin
*
content-length
244
x-amz-cf-id
Q83zFFnL3_XQzmpgOJRFLUWpkfGjZETBNu7gsSBhoP-JG8KcF1kYzA==
esp.js
cdn.id5-sync.com/api/1.0/ 		83 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.id5-sync.com/api/1.0/esp.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c216860f82a201e909b917ff2eca53e9787b05ec1fe5a69a0d4b994d95781c5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
strict-transport-security
max-age=15552000; includeSubDomains; preload
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 20 Jun 2023 07:12:13 GMT
server
cloudflare
x-amz-request-id
X6X36P6AYV2RQ42X
age
1668
etag
W/"916c7961f99d2ada149bc1a94a1bf864"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
cache-control
public, max-age=3600
cf-ray
7da681eeab888cae-EWR
x-amz-id-2
Vt7z9O67X5IMwF7HB0lJZjA0pk0GGLfP/eXvd1CLp7odJN4rh0LZcqY/M5Rrvs4TjRmjd4RbCdQbemMQA/Slwg==
pubcid.min.js
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 		732 B
644 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:44:38 GMT
x-content-type-options
nosniff
content-encoding
br
age
30296
x-jsd-version
master
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
439
x-served-by
cache-fra-eddf8230042-FRA, cache-yul12832-YUL
x-jsd-version-type
branch
etag
W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
uid2SecureSignal.js
cdn.prod.uidapi.com/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2511:a00:a:e047:753:be1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
null
Date
Tue, 20 Jun 2023 09:17:00 GMT
Via
1.1 42cdf90926c91454b0e8865bb13f3962.cloudfront.net (CloudFront)
Last-Modified
Thu, 04 May 2023 00:14:06 GMT
Server
AmazonS3
X-Amz-Cf-Pop
JFK50-P6
Age
37659
x-amz-server-side-encryption
AES256
ETag
"4d5acbf33f4a0592ac0515db92fe88e6"
X-Cache
Hit from cloudfront
Content-Type
text/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1858
X-Amz-Cf-Id
PG3v-IUhgE-GM577K4I_7Cy-vGpsBe2mVh0BYo3_4Bf6Nrwl1mWJig==
publishertag.ids.js
static.criteo.net/js/ld/ 		42 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.ids.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
839c424b188a9bdafd46e5b643a2c5afb4b7df5e51f0321ffafd5f23b118e259
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 31 May 2023 13:09:50 GMT
server
nginx
etag
W/"6477471e-a980"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:38 GMT
fp.min.js
fp-cdn.azureedge.net/prod/dfm/ 		65 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://fp-cdn.azureedge.net/prod/dfm/fp.min.js?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C6F) /
Resource Hash
f3988a8a95c5faec9bb5307667596b220a12d277072950244393b5f33091e2fb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
content-md5
VJ6k3v9dRV/0qT39eqFDjw==
age
20003
x-cache
HIT
content-length
23424
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 14:09:43 GMT
server
ECAcc (nya/1C6F)
etag
0x8DB6B4EABC41F1B
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
f26d5fd1-801e-003f-7f81-a33f1d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
g2insights.min.js
g2insights-cdn.azureedge.net/prod/dfm/ 		220 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://g2insights-cdn.azureedge.net/prod/dfm/g2insights.min.js?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C11) /
Resource Hash
743fab9929b06e6ea08ee7296b84d0068d27d9fe7552b69f351a3298b968910a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
content-md5
3vlRE270poARifXWcdSFQA==
age
43062
x-cache
HIT
content-length
49062
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:19:27 GMT
server
ECAcc (nya/1C11)
etag
0x8DB6B155BAB7A80
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
866cddb9-601e-0045-604b-a3225d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
t8y9347t.min.js
cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/ 		879 KB
205 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C1A) /
Resource Hash
1313e544d95566c0ed767f40117a8287940c2856fb450d6a4224b8db33a97902

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
content-md5
TKR/2Tq6xUUECucxJTe0nw==
age
1588
x-cache
HIT
content-length
209412
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:14:24 GMT
server
ECAcc (nya/1C1A)
etag
0x8DB6B14A70BE01E
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
02973d82-b01e-0046-04ab-a3c339000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
rules-p-4ctCQwtnNBNs2.js
rules.quantcount.com/ 		3 B
448 B 		Script
General
Check archive.org
Download Go to
Full URL
https://rules.quantcount.com/rules-p-4ctCQwtnNBNs2.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21dd:5800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 03:07:12 GMT
via
1.1 ea5efad48fd2ca3e2050f885ef5ad57c.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-C2
age
59847
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
3
last-modified
Sat, 04 Mar 2017 19:57:14 GMT
server
AmazonS3
etag
"8a80554c91d9fca8acb82f023de02f11"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=86400
accept-ranges
bytes
x-amz-cf-id
Aib50QbzyKbrAn4nsOsclAf4OIAgru7UJ-5Zl1o1XNDMk7nZHXxHxg==
analytics.js
www.google-analytics.com/ 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 20 Jun 2023 17:56:36 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
6482
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Tue, 20 Jun 2023 19:56:36 GMT
tag.js
s.btstatic.com/ 		34 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.btstatic.com/tag.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.117.46.235 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-117-46-235.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:38 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Feb 2023 15:10:42 GMT
Server
nginx
Vary
Accept-Encoding
P3P
CP=NOI DSP COR NID
Content-Type
application/javascript
Cache-Control
public, max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
12525
js
www.googletagmanager.com/gtag/ 		254 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c40d4a64885f7716333758ee5f7c62d2ffdefa767e00456d30501941b88813c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
88677
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 20 Jun 2023 19:44:38 GMT
ml.br.js
js.matheranalytics.com/static/ltm/ma23578/wp/27/
Redirect Chain
  • https://js.matheranalytics.com/s/ma23578/239876506/wp/ml.js?cb=1627
  • https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
150 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
107.178.250.234 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
234.250.178.107.bc.googleusercontent.com
Software
nginx /
Resource Hash
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 19 Jun 2023 20:49:16 GMT
content-encoding
br
via
1.1 google
last-modified
Mon, 12 Jun 2023 20:29:05 GMT
server
nginx
age
82522
etag
"85aef1250c3704a499337dcfc565d621"
vary
Accept-Encoding
x-cache
HIT Mon, 12 Jun 2023 20:39:11 GMT
content-type
application/x-javascript
cache-control
public,max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44324

Redirect headers

date
Tue, 20 Jun 2023 19:44:38 GMT
via
1.1 google
server
nginx
vary
Accept-Encoding
location
https://js.matheranalytics.com/static/ltm/ma23578/wp/27/ml.br.js
cache-control
public, max-age=269200
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-served-by
3-gc-northeast1c-54231012
demconf.jpg
dpm.demdex.net/ Frame FD3B
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=82530&dpuuid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=
42 B
940 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Server
34.228.89.16 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-228-89-16.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

DCS
dcs-prod-va6-1-v048-0e3a19787.edge-va6.demdex.com 2 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
Jp+W/kDKQdA=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-va6-1-v048-0d4a96e26.edge-va6.demdex.com 0 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
HRAr2pvmT0I=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=82530&dpuuid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
check
pixel.tapad.com/idsync/ex/receive/ Frame FD3B
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2499&partner_device_id=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341
95 B
428 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

date
Tue, 20 Jun 2023 19:44:38 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin
*
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2499&partner_device_id=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
pixel.gif
load77.exelator.com/ Frame FD3B
Redirect Chain
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=
  • https://loadm.exelator.com/load/?p=204&g=700&j=0&buid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=&xl8blockcheck=1
  • https://load77.exelator.com/pixel.gif
43 B
366 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://load77.exelator.com/pixel.gif
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
2a02:6ea0:c400::12 New York, United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
newyorkUSNY
date
Tue, 20 Jun 2023 19:44:38 GMT
x-cache
HIT
x-77-cache
HIT
x-age
984598
x-accel-date
1686305680
content-length
43
x-77-nzt
AVm7sQ9Hunv/FgYPAA
x-accel-expires
@1687342480
last-modified
Wed, 25 Oct 2017 17:03:56 GMT
server
CDN77-Turbo
etag
"59f0c3fc-2b"
x-77-nzt-ray
49be140814a5c991a60192644ca1f233
content-type
image/gif
access-control-allow-origin
*
accept-ranges
bytes

Redirect headers

date
Tue, 20 Jun 2023 19:44:38 GMT
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location
https://load77.exelator.com/pixel.gif
content-type
image/gif
cache-control
no-cache
access-control-allow-credentials
true
content-length
0
um
sync.teads.tv/ Frame FD3B 		23 B
279 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=73&uid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.197.46 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-200-197-46.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Tue, 20 Jun 2023 19:44:38 GMT
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
cache-control
max-age=0, no-cache, no-store
server
akka-http/10.2.10
content-length
23
content-type
image/gif
qmap
sync.crwdcntrl.net/ Frame FD3B
Redirect Chain
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=
  • https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=&ct=y
49 B
735 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=&ct=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
52.72.123.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-123-193.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://pixel.sitescout.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.43.168
content-length
49
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://sync.crwdcntrl.net/qmap?c=1389&tp=STSC&tpid=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=&ct=y
cache-control
no-cache
x-server
10.40.40.237
content-length
0
expires
0
e50d327a-1b3a-41b0-9e62-d205a2ac6cb8
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/e50d327a-1b3a-41b0-9e62-d205a2ac6cb8
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
65c25df5710daac71512ce59624729c1
a869.mercurynews.com/plugin/library/ 		438 KB
138 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/plugin/library/65c25df5710daac71512ce59624729c1
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
d8b0939d4ad62069a09916859d301d5a0d9c00e9174ad682c53bc122a35bf80e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 31 May 2023 07:17:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
1772858
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
140593
x-xss-protection
1; mode=block
last-modified
Tue, 30 May 2023 07:17:00 GMT
server
-
etag
65c25df5710daac71512ce59624729c1
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
nClWyy8QmkPdU4L2qRDt-fYCC5nTddaj6YEGMcd7z-OtX9gRfGmxqQ==
expires
Thu, 30 May 2024 07:17:00 GMT
LB-Zone-2
a869.mercurynews.com/DG/DEFAULT/rest/rpc/207/ 		3 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207/LB-Zone-2?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A38%2B00%3A00&ts=1687290278290
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
0e74e6ac26ea124d4b1aec4be40188ed8124fdca0371b210a14fcf68a953302e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
1144
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
9n3fii033T6lV1BOCA6HTjfneW31jedAdiqfKLBCJOaZUbh48O3LRA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
/
cmp.osano.com/ Frame DAEB 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cmp.osano.com/
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2510:aa00:3:b7e:8940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45304
content-encoding
br
content-type
text/html
date
Tue, 20 Jun 2023 07:09:35 GMT
etag
W/"287b497c992487af362d33204f87d28f"
last-modified
Thu, 21 Oct 2021 22:01:08 GMT
referrer-policy
strict-origin-when-cross-origin
server
AmazonS3
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding Origin
via
1.1 9750f5ee94b45ad0faba87b3fac2aad6.cloudfront.net (CloudFront)
x-amz-cf-id
ihjoMFw-VVih_CpXZ3RbuT83ngJOTaNgST4XOci4iho2LcBulCgudw==
x-amz-cf-pop
JFK50-P5
x-amz-version-id
xT1PkIFehetvNf5lINcU02FbT3u47kBr
x-cache
Hit from cloudfront
x-content-type-options
nosniff
x-xss-protection
1; mode=block
record
consent.api.osano.com/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://consent.api.osano.com/record
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.116.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-116-7.jfk50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
*
content-length
0
content-type
application/json
date
Tue, 20 Jun 2023 19:44:38 GMT
via
1.1 0252b483f7b420504a413a83f987b080.cloudfront.net (CloudFront)
x-amz-apigw-id
G1UyDENPIAMFnIg=
x-amz-cf-id
p1Zi96m5tpanRowPyGjLSqRrry98YWpvG6mWtDyWSsjB64g-_c1uvQ==
x-amz-cf-pop
JFK50-P6
x-amzn-requestid
a39ffcf5-b2b7-4757-9193-1ff500edcbe3
x-cache
Miss from cloudfront
load.js
s.ntv.io/serve/ 		575 KB
157 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ntv.io/serve/load.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.69.53 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-69-53.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
c5993f8467dfbb45dfd3f751abd48089b840da8105caca380d0bc0f8ec387b11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:38 GMT
Content-Encoding
gzip
x-amz-request-id
13HPF9TQQRZ9A5F4
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
x-amz-id-2
oYeCCuxnZR4lYlvGh9tr/o87kDOZGYqlsMVtDcLGrOgXXBy8rXqBz6g6tYhZdChY3Qq/iD4B2vw=
Last-Modified
Fri, 16 Jun 2023 13:31:32 GMT
Server
AmazonS3
ETag
"9ac11617889ee511c7463118047f195a"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
a-04i4.min.js
b-code.liadm.com/ 		42 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b-code.liadm.com/a-04i4.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:23cb:7c00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
dc0da2082ec514b4250ffe29a176826c3aef94d4ca0f887586528add66a99f16

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 06:23:34 GMT
content-encoding
gzip
via
1.1 043cf9310ff19c0e58a0b6e76877f570.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P1
age
48064
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
"public, max-age=86400"
x-amz-cf-id
AVzkL3Yon3ulikhkbaCAUFMJW7r3oDoX-Na8_Z0CYg4gUA1iOfSeKA==
beacon.js
sb.scorecardresearch.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.93.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-41.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 02:46:03 GMT
content-encoding
gzip
via
1.1 67d3f8867c3d6540e7495f9026c9c57a.cloudfront.net (CloudFront)
last-modified
Thu, 09 Mar 2023 09:22:40 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P8
age
61116
etag
W/"a06e7a176f40dc26aa5e9567ac9d2d5e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400
x-amz-cf-id
nIO3k2EoefyPRUm_nvc7INsLqYPolER7Z8BhAT1NtV49Srj0ojFVEA==
json
trc.taboola.com/medianewsgroup-mercurynews/trc/3/ 		104 KB
30 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/medianewsgroup-mercurynews/trc/3/json?tim=19%3A44%3A38.372&lti=deflated&data=%7B%22id%22%3A301%2C%22ii%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1687254511415%2C%22vi%22%3A1687290278360%2C%22cv%22%3A%2220230620-6-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22bv%22%3A%220%22%2C%22wc%22%3Atrue%2C%22ul%22%3A%5B%22en-US%22%2C%22en%22%5D%2C%22uad%22%3A%7B%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D%2C%22cmps%22%3A0%2C%22ga%22%3Afalse%2C%22ccpa_ps%22%3A%221---%22%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bu%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%22%2C%22vpi%22%3A%22%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A1600%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A1200%2C%22dw%22%3A1600%2C%22dh%22%3A6979%2C%22nsid%22%3A%22medianewsgroup-network%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A6%2C%22uim%22%3A%22thumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22orig_uip%22%3A%22Below%20Article%20Thumbnails%22%2C%22cd%22%3A5182.578125%2C%22mw%22%3A954.875%7D%5D%2C%22cacheKey%22%3A%22text%3D%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2CBelow%20Article%20Thumbnails%3Dthumbnails-a%3Apub%3Dmedianewsgroup-network%3Aabp%3D0%22%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D&llvl=2
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20230620-6-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
d900fce5f1d94651e36b997a118c660e4f2196d2df3cfc9e2dd448330978babd

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

x-vcl-time-ms
582
date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
via
1.1 varnish
x-fastly-to-nlb-rtt
9418
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v2
x-served-by
cache-yul12823-YUL
server
nginx
x-timer
S1687290278.391989,VS0,VE582
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
record
consent.api.osano.com/ 		0
439 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://consent.api.osano.com/record
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.116.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-116-7.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/json
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
via
1.1 0252b483f7b420504a413a83f987b080.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P6
x-amzn-trace-id
Root=1-649201a6-44aed8a62f0c5b686485f39d
x-amzn-requestid
bae7845e-f1ad-4671-866e-5e04bf807444
x-cache
Miss from cloudfront
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
*
access-control-allow-headers
Accept, Authorization, Content-Length, Content-Type, Origin, X-Requested-With
x-amz-apigw-id
G1UyEFrcIAMFXMQ=
x-amz-cf-id
W4IzmAzUQAtkAkQTJrFH-3VFEc06GtJgg6zaGnnLW2AYMoZdA--egw==
47af4dde-e338-467f-81fa-09768071d8bc
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/47af4dde-e338-467f-81fa-09768071d8bc
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
35b52f30-9f3d-4d40-ac0c-d819c8553043
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/35b52f30-9f3d-4d40-ac0c-d819c8553043
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
d2b21db0-633e-4e54-b6d5-09efc7ed015b
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/d2b21db0-633e-4e54-b6d5-09efc7ed015b
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
FUtg69tL.js
cdn.jwplayer.com/libraries/ Frame D961 		108 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jwplayer.com/libraries/FUtg69tL.js
Requested by
Host: tags.remixd.com
URL: https://tags.remixd.com/player/v5/index.js?cb=%%CACHEBUSTER%%
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2209:d200:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
openresty /
Resource Hash
ebe57ea45a2226e928d739f6bdd9bb1d0425134d06a8d88cc0c669cfcb3123e2

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:42:53 GMT
content-encoding
gzip
via
1.1 2ba01a121d51ee735a8dde7a86ed73b6.cloudfront.net (CloudFront)
server
openresty
x-amz-cf-pop
EWR53-P1
age
105
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=180
x-robots-tag
noindex, indexifembedded
content-length
41225
x-amz-cf-id
nrDIyi5EnjyfotxmD6iFEGWBVXXrYOEASyAe-N_usU_ZVVYmurV02w==
pmk-20220605.3.js
pm-widget.taboola.com/medianewsgroup-network/ 		109 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pm-widget.taboola.com/medianewsgroup-network/pmk-20220605.3.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
463b965e90a6c1e92161047e09f18a7b0c5bfe39c59de875536a744922f18285

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
EpZzlJAx.0y9.uC5nEuXRKLfz.04Efo4
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Tue, 20 Jun 2023 19:44:38 GMT
x-amz-request-id
DAM11Y8WW0441GFC
age
1869673
x-cache
HIT, HIT
content-length
30633
x-amz-id-2
R1WtWYmDdmYhnE6C2z0FDpK8g1Uy3NwQv2MAMZmqF1e28TOsr7BJebrxzYXfpeuqVE45bHxiAj4=
x-served-by
cache-bur-kbur8200175-BUR, cache-yul12823-YUL
last-modified
Tue, 30 May 2023 04:23:22 GMT
server
AmazonS3
x-timer
S1687290278.449080,VS0,VE0
etag
"ad88e58bdaa38d8b8e9028ad431a5e02"
vary
Accept-Encoding,,
content-type
application/javascript; charset=utf-8
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
8, 2125
increment
id5-sync.com/api/esp/ 		0
328 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://id5-sync.com/api/esp/increment?counter=no-config
Requested by
Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.19.138.119 , France, ASN16276 (OVH, FR),
Reverse DNS
ns31533570.ip-162-19-138.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:38 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
access-control-allow-credentials
true
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
collect
www.google-analytics.com/g/ 		0
165 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-LMTT1ZNHB1&gtm=45je36e0&_p=1059800600&cid=461448689.1687290279&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1687290278&sct=1&seg=0&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cs
digitalfirstmedia.blueconic.net/DG/DEFAULT/ 		66 B
857 B 		Script
General
Check archive.org
Download Go to
Full URL
https://digitalfirstmedia.blueconic.net/DG/DEFAULT/cs?bcsessionid=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&&callback=bc_json210
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.237.129.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-237-129-106.compute-1.amazonaws.com
Software
- /
Resource Hash
bf26f6a32c5ed97a743a72e5fad86c815d423834bbe1e23b9c1410e31b5282df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
-
x-permitted-cross-domain-policies
master-only
content-type
text/javascript; charset=utf-8
p3p
policyref="", CP="DSP"
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
content-length
86
x-xss-protection
1; mode=block
expires
Thu, 01 Jan 1970 00:00:00 GMT
tag
s.thebrighttag.com/ 		14 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.thebrighttag.com/tag?site=t4tmU86&H=-2umnyqz
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.13.23.188 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-13-23-188.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
f67c1dae64731f037f0dcd7598af600024c9546bbdeed1c9f7185b027ef65bb4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
x-bt-requestid
e4786c80-0fa2-11ee-9961-0000ac1700e6
server
nginx
etag
ea073f4c32be2f10a6117ca27c31b8e7
content-type
text/javascript
access-control-allow-origin
https://www.mercurynews.com
p3p
CP=NOI DSP COR NID
cache-control
private, must-revalidate
content-length
14502
expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel;r=1941155816;labels=BayAreaNewsGroup;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-wor...
pixel.quantserve.com/ 		35 B
371 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.quantserve.com/pixel;r=1941155816;labels=BayAreaNewsGroup;source=gtm;rf=0;a=p-4ctCQwtnNBNs2;url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F;uht=2;fpan=1;fpa=P0-396458604-1687290278155;pbc=;ns=0;ce=1;qjs=1;qv=c818c8ec-20230509111053;cm=;gdpr=0;us_privacy=1---;ref=;d=mercurynews.com;dst=0;et=1687290278624;tzo=0;ogl=type.article%2Ctitle.Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%252C%E2%80%99%20ex-Spotify%20e%2Curl.https%3A%2F%2Fwww%252Emercurynews%252Ecom%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd%2Cdescription.Even%20though%20Markle%20only%20produced%2012%20hours%20of%20podcast%20content%20in%202%201%2F2%20years%252C%20she%2Csite_name.The%20Mercury%20News%2Cimage.https%3A%2F%2Fwww%252Emercurynews%252Ecom%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1%252Ejp%2Cimage%3Awidth.1024%2Cimage%3Aheight.683%2Cimage%3Aalt.%2Clocale.en_US;ses=73987288-f683-4e52-8eba-d4508e91589d;mdl=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800b:21:4cb8:1820:80ca:50f7 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:38 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type
image/gif
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
card-interference-detector.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/card-interference-detector.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2aa50c9706f2175ff0a141b65a82f4c0a8907f75779f00d9d29d31a09c58121f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
d9g80bYGwlrI5Ugcc2XKm7V6T0Er6clB
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:38 GMT
x-amz-request-id
RM19DYDTDKDAXYEN
age
33655
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
2179
x-amz-id-2
LfgJThIAG/Fwcv5cOwYkq/rGd15anZbnC67Rtnx4zr6ZNOJdBGBTqY5GenmjLzGElZzdRQ1KIFA=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:23:43 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290279.656783,VS0,VE0
etag
"72624d6dc4cb1ef95c5884952b9a75a2"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
83
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
14631
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2c95bbac8e167a1fd9297768d9c45d1f50db54733b750ae889b3a5efd2fae8fa

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/svg+xml
t8y9347t.min.css
cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/ 		389 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.css?
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/1C04) /
Resource Hash
8f5b3f7177261796d36de2d220664c09162d3877eb2e3868406c27ac952520a1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
content-md5
w1JcKG+K3j0xPG8xaqE6vA==
age
1587
x-cache
HIT
content-length
55210
x-ms-lease-status
unlocked
last-modified
Mon, 12 Jun 2023 07:14:24 GMT
server
ECAcc (nya/1C04)
etag
0x8DB6B14A70ACED9
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
011c085f-f01e-001a-1dab-a39661000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
wrap.js
cdn.confiant-integrations.net/gptprebidnative/202305161109/ 		247 KB
76 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.confiant-integrations.net/gptprebidnative/202305161109/wrap.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:220a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9b8757ef83403b67a3f6d10da0c8f4259179fe48a775020aeb65ab9e1791cc3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 16 May 2023 15:12:41 GMT
server
cloudflare
x-amz-request-id
FT4HVGQB7CCRFX0J
age
3036298
etag
W/"c445da83949e16f2c7f56d37a9f719f0"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=31536000
cf-ray
7da681f24c384bbe-YUL
alt-svc
h3=":443"; ma=86400
x-amz-id-2
nO4SmJlCFWE3tYLd1eHTnRzftKXrxOvU4kwqYbbPBc9j7s8g5EWJxiHO9/oA0MLoZxzVGL5i6BU=
fddc5adb29bdf95c848ea54469cf60a5
a869.mercurynews.com/templates/ 		479 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/templates/fddc5adb29bdf95c848ea54469cf60a5
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
2f218987261e49e368f7f85f9e5bf66f49f62032e96bb064c43064df8fc4e2fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 26 Mar 2023 19:28:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
age
7431382
x-cache
Hit from cloudfront
p3p
policyref="", CP="DSP"
content-length
71125
x-xss-protection
1; mode=block
last-modified
Sat, 25 Mar 2023 19:28:16 GMT
server
-
etag
fddc5adb29bdf95c848ea54469cf60a5
content-type
text/javascript; charset=utf-8
cache-control
public, no-cache="Set-Cookie", max-age=31536000
x-robots-tag
noindex, nofollow
x-amz-cf-id
-J5aZCUN8fPUfIv4NwRZewlPrQCeo9XnXBTB1_8ZHG4W-18SoLB9Lg==
expires
Mon, 25 Mar 2024 19:28:16 GMT
207
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		192 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A38%2B00%3A00&ts=1687290278854
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
9f24d6f6308f119fdf8fdf6150b6ea48fef956916ab7f22abc1725f7335a7db1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
154
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
PzeogjHTiLeX95TtZJINJOA7p6LM1AI44r5P4ejA1PePgisrUg5bBQ==
expires
Thu, 01 Jan 1970 00:00:00 GMT
fbevents.js
connect.facebook.net/en_US/ 		108 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
64816ef42196992f1120608cafa36df8e03c81064551abb6f23bc00f69bf6727
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:44:38 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
27810
x-xss-protection
0
pragma
public
x-fb-debug
mdIdArJFTLvejrVAyn5JsbO6DnFDFTXcsXmUQcTjasX7tMl1ThwSSVUibKo4FYIntbGyVhSenlRayww24QymUQ==
x-fb-trip-id
1679558926
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
stats
a869.mercurynews.com/rest/recommendations/ 		14 B
849 B 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/rest/recommendations/stats?storeId=0595003b-1825-43bc-89bd-9877ca21042f&action=view&itemId=9968021&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&profileId=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&isEntrypage=true&hash=788aeb3068b96c1677f6d8b260dbf322&lastmodified=1687284760000&referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&&callback=bc_json211
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
1c6579a152145ab4c6708dbacf4092ff71d4ccb3f7e760516c04fd99b7ef53ea
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
34
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
text/javascript;charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
x-amz-cf-id
3Nmo8IR56tWhPG2IXIPe7Tpd1sIaBWcUKjHBzK7nbNlR6HzmHPLqXA==
expires
Thu, 01 Jan 1970 00:00:00 GMT
207
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		565 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A38%2B00%3A00&ts=1687290278912
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
95112c9137bfbf4201f0da94b6bddc5067ab270455419e5db9fec6d6a061be6b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
180
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
kfFX67x-vVM6mh0FFzCxJfLDXYy_vWECYfVC6J4Yx_BdD7m4u7juHw==
expires
Thu, 01 Jan 1970 00:00:00 GMT
207
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		189 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A38%2B00%3A00&ts=1687290278915
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
dc64a9158182178303644e2e2db0e0b52d48d655ac751365b64aea64b275f245
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
168
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
KnxNltPdplUxvyjYFGGy0V11CwRLYZDKxdB2ZpJ-XR68eZyUjkPg9w==
expires
Thu, 01 Jan 1970 00:00:00 GMT
207
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		377 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A38%2B00%3A00&ts=1687290278917
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
41c28767173fcc7e5858fe1e7ec9644a6e1c2a58a3c41b630463bf85ad063f64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
177
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
0Pf3Faaaw2J_v8wbckLpQkOVlkzS7n8l4MPvpCYWfIUXQU6P8PFszw==
expires
Thu, 01 Jan 1970 00:00:00 GMT
207
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		5 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A38%2B00%3A00&ts=1687290278919
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
4518dbd683cbb1523ce069867d2a9405d3b5073244568afc7a9336f9007dfca9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
2608
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
INZLJLDqsfjvVgDxJgiW1cMSy45K3k8FIqP3ZMnV9EJ_bUsKUbxdpw==
expires
Thu, 01 Jan 1970 00:00:00 GMT
207
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		189 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A38%2B00%3A00&ts=1687290278927
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
d40c19c83303bfe197a42b9fee896325dc7f81a54decd63441dcb0302055caf4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
168
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
YAkChsnySdwsCfQu2vvstcZg10nfQPtLNj0JdlE-P6MrxPuuihBszw==
expires
Thu, 01 Jan 1970 00:00:00 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pv&page=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&artid=9968021&artpubt=1687284760&artsrc=Bay%20Area%20News%20Group&arttype=free&artupt=1687287137&auth=Martha%20Ross&chrcnt=5021&cms=WP&hier=Entertainment%7CThings%20To%20Do&ptype=article&pubname=The%20Mercury%20News&sec=Entertainment&wrdcnt=801&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=1ba06b74-e5b8-4745-b2c0-f95615dba5ea&pid=2d10aa57-19ef-4ec0-84a8-3899d30f307c&dtm=1687290278958&qnm=_matherq&visible=1&tabid=40005137-57dc-449b-98c4-09fff3481006&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=1600x6979&tofa=1687290279&vid=1&lvidt=1687290279&duid=1bfd33dc-1dec-4854-b026-244377afad71&fp=967226427&cid=ma23578&mrk=239876506&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTY4NzI5MDI3NjU2NyIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiI0NC43bWIiLCJoZWFwVCI6IjY0bWIiLCJmc3RQYWludCI6Ijc0MCIsImZldGNoUyI6IjM4IiwiZG9tYWluUyI6IjM5IiwiZG9tYWluRSI6IjQwIiwiY29ublMiOiI0MCIsImNvbm5FIjoiNzQiLCJzc2xTIjoiNTUiLCJyZXF1UyI6Ijc1IiwicmVzcFMiOiI5MSIsInJlc3BFIjoiMTIwIiwiZG9tTG9hZCI6Ijk1IiwiZG9tSW50ZXIiOiIxMDU4IiwiZG9tTG9hZFMiOiIxMDg5IiwiZG9tTG9hZEUiOiIxMTE4In0sImlkZW50aXRpZXMiOlt7InR5cGUiOiJnYSIsImlkIjoiNDYxNDQ4Njg5IiwicmVmVGltZSI6IjE2ODcyOTAyNzg5NTcifV0sImNhdGVnb3J5Ijp7ImNhdGVnb3JpZXMiOltbIkVudGVydGFpbm1lbnQiLCJUaGluZ3MgVG8gRG8iXV19LCJhdXRoMF9zdWIiOiIiLCJhdWRpZW5jZSI6W3sicHJvdmlkZXIiOiJ1c2VyREIiLCJzZWdtZW50cyI6WyJNQVRIRVJfVTlfSU5TVEFOVEFfMjAyMDAyMDMiXSwicGFnZUlkIjoiMmQxMGFhNTctMTllZi00ZWMwLTg0YTgtMzg5OWQzMGYzMDdjIn0seyJwcm92aWRlciI6ImlTZWdzIiwic2VnbWVudHMiOlsiTUFUSEVSX1U5X0lOU1RBTlRBXzIwMjAwMjAzIl0sInBhZ2VJZCI6IjJkMTBhYTU3LTE5ZWYtNGVjMC04NGE4LTM4OTlkMzBmMzA3YyJ9XX0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:39 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1687290278191&cv=11&fst=1687290278191&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=124969367.1687290278&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c3c69d561e2ecc27d9b8ac902008f419f8f0965607d11fb465f292182af8965e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:39 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1433
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
iu3
s.amazon-adsystem.com/ Frame BEBB
Redirect Chain
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift
  • https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
373 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
19cf792a649556b6e99d788a69b1e501dc0748c010896e4fd4081eca8ab0983c
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
373
Content-Type
text/html;charset=ISO-8859-1
Date
Tue, 20 Jun 2023 19:44:39 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
VSRDW8G561X5ZFTV9X70

Redirect headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:39 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Location
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
3ENRH55HBKYAMX2XZ33X
launchpad.bundle.js
launchpad.privacymanager.io/1/ 		25 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://launchpad.privacymanager.io/1/launchpad.bundle.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.116.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-116-69.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b9d318b3157ccbfc3bb00e82a446613294f9a592c01537662386bd848882b7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
IBczV1acfLsLLKzHm11PkizTXPxE9_cH
content-encoding
br
via
1.1 1d45cc40d1dd29d2b3aaefb9f85bceee.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 19:42:36 GMT
x-amz-cf-pop
JFK50-P6
age
124
x-amz-server-side-encryption
AES256
x-amz-meta-codebuild-buildarn
arn:aws:codebuild:eu-west-1:469675294282:build/LaunchPadLibraryBuild-prod:f09170b2-5416-4e55-be91-38e5eec207ec
x-cache
Hit from cloudfront
x-amz-meta-codebuild-content-md5
a78f2a5a4864424e54348ce47b156abb
last-modified
Thu, 10 Mar 2022 13:10:48 GMT
server
AmazonS3
etag
W/"3e312624cdc2445a38a716f92dc3c0cd"
vary
Accept-Encoding
content-type
application/x-javascript
x-amz-meta-codebuild-content-sha256
e4ad213b137401d20a50fe1692169cc5f8b39867b6fe39afed7e307e1b9c967e
cache-control
must-revalidate,public,max-age=3600
x-amz-cf-id
Vj-Z2DldhDxC5WFHup3TIpcKVxH6FWDj5osseFxc_q3_glUJBr3Qpw==
css2
fonts.googleapis.com/ Frame D961 		3 KB
624 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
933ff38629199ba200d23e1a3afda3ca9cae06352169926a4609942ab4d3742b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 19:02:35 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:44:39 GMT
ping.gif
player-files.remixd.com/ Frame D961 		43 B
583 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://player-files.remixd.com/ping.gif?action=playerImpression&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=1&sessionId=7c7add39-d635-41f2-a356-a3663ba9c6e0&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
x-guploader-uploadid
ADPycdtz-zWzm_r0lTd0qCFBAR1mOmUEDIJH91HkUomEzXTdhOlskBED5S2q4H8zclSKdrDHxXRqbG0CLIkJW5-F5N3L
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:44:39 GMT
ping.gif
player-files.remixd.com/ Frame D961 		43 B
190 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://player-files.remixd.com/ping.gif?action=loading&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=2&sessionId=7c7add39-d635-41f2-a356-a3663ba9c6e0&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
x-guploader-uploadid
ADPycdvfJpk3v89j46f9tI0FkWtiEMUpfsBA65Rzj-rEQ5za3cIJ9xur_eqksa0bOrjb5WxgJBcMAqcUekNIuYLiEjAe
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:44:39 GMT
ping.gif
player-files.remixd.com/ Frame D961 		43 B
189 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://player-files.remixd.com/ping.gif?action=loaded&userId=null&referrerUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&domain=mercurynews.com&adDuration=&inViewDuration=&sessionDuration=3&sessionId=7c7add39-d635-41f2-a356-a3663ba9c6e0&volume=null&speed=1&position=null&mediaLength=null&isAMP=false
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.38.143 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
143.38.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
x-guploader-uploadid
ADPycdvja2E2jyuXLIiylTsi1NBlu8wc9O8tj7r3tTpduqjR3U_SOldXcgilupjvQ8s_07Y8hZHyUWpp3-T9vSilFweL
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
3
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
last-modified
Wed, 23 Oct 2019 15:45:02 GMT
server
UploadServer
etag
"cc8f8e28fe4d3aa85ca835a029fe08a5"
x-goog-generation
1571845502045744
content-type
image/gif
access-control-allow-origin
*
x-goog-hash
crc32c=CskzBw==, md5=zI+OKP5NOqhcqDWgKf4IpQ==
access-control-expose-headers
Content-Type
cache-control
no-cache, no-store, must-revalidate
x-goog-stored-content-length
43
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:44:39 GMT
3e95f6d2-69ac-485f-b5e5-3b57bc2873ac
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/3e95f6d2-69ac-485f-b5e5-3b57bc2873ac
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
self
api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/ 		613 B
791 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-mg2.db-ip.com/v2/p14891b727f063924f0d86d8a8e5063678abd2ac/self?_=1687290279076
Requested by
Host: fp-cdn.azureedge.net
URL: https://fp-cdn.azureedge.net/prod/dfm/fp.min.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.4.15 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab7ff044ec2e95bca736f374cf86af08c260384fbcf871032bd54e2b4ef509a9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Tue, 20 Jun 2023 19:44:39 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2GBK5vnhOUhJ88ni8zhE15wSEz5w2nykYQaYFBQ%2FFoJfTI%2FMUsIff4y6yXPlt4I9lwa5FK0RxC70c%2BOaxWYddAi3TmAS%2FUSc9ETqPYh7Zgh9Z8v1kSpsviJsR7qnMusaI%2Fl0"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=1800
cf-ray
7da681f4bb6ac42a-EWR
alt-svc
h3=":443"; ma=86400
ai.0.js
az416426.vo.msecnd.net/scripts/a/ 		94 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:17a5:191a:18d5:537:22f9 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/79DC) /
Resource Hash
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:39 GMT
content-encoding
gzip
x-ms-meta-lastmodified
2020-10-01 19:31:04
content-md5
HdY95yzx9wIyQkVEGES+Ew==
age
1114
x-cache
HIT
content-length
22495
x-ms-lease-status
unlocked
last-modified
Thu, 11 Mar 2021 07:46:59 GMT
server
ECAcc (nya/79DC)
etag
0x8D8E461DA1A5889
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c079a44a-b01e-00b5-74ad-a369c5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800
x-ms-version
2009-09-19
expires
Tue, 20 Jun 2023 20:14:39 GMT
index.js
cdn.pranmcpkx.com/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pranmcpkx.com/index.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/7991) /
Resource Hash
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:39 GMT
content-encoding
gzip
content-md5
nynBpfvYghYqzIzsvfssRw==
age
206501
x-cache
HIT
content-length
2382
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jun 2022 17:08:13 GMT
server
ECAcc (nya/7991)
etag
0x8DA5083F65AD9E0
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
x-ms-request-id
771178af-101e-005f-22ce-a14382000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
DFM__BANGWPPRODWAB__MERC.json
cdn.czx5eyk0exbhwp43ya.biz/prod/data/dfm/ 		521 KB
522 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.czx5eyk0exbhwp43ya.biz/prod/data/dfm/DFM__BANGWPPRODWAB__MERC.json?_=1687290279126
Requested by
Host: cdn.czx5eyk0exbhwp43ya.biz
URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
2943a138fb8248f4ef8d8ac14a988ef46f8bb5d3aa964ff227082c1651e46dbf

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
AppendBlob
date
Tue, 20 Jun 2023 19:44:38 GMT
last-modified
Wed, 14 Jun 2023 20:35:44 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-committed-block-count
1
etag
0x8DB6D16EDC2DB4F
content-type
application/octet-stream
access-control-allow-origin
*
x-ms-request-id
a99a5428-c01e-0087-60af-a364db000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,x-ms-blob-committed-block-count,Content-Length,Date,Transfer-Encoding
cache-control
no-cache
x-ms-version
2009-09-19
content-length
533460
ad_300_250.jpg
paywall-ad-bucket.s3.amazonaws.com/ 		631 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://paywall-ad-bucket.s3.amazonaws.com/ad_300_250.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.216.108.235 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:40 GMT
Last-Modified
Tue, 15 Oct 2019 13:44:16 GMT
Server
AmazonS3
x-amz-request-id
057TCKSNQFNSFPRW
ETag
"ef2cc7f55b7ab677b023e36033e26471"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
631
x-amz-id-2
BR4DtJZzbJd9ALC+/6K6i3RBjz44uv4FiYmuOoRZZgpyRjzXE6SQtTN9fOCg814dRdcCsnU2Li8=
x-amz-meta-s3b-last-modified
20191015T134358Z
1x1-pixel.png
ams-pageview-public.s3.amazonaws.com/ 		68 B
480 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ams-pageview-public.s3.amazonaws.com/1x1-pixel.png?id=1a461e4fcca4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.5.28.156 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
s3-1-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:40 GMT
Last-Modified
Mon, 26 Oct 2020 16:52:19 GMT
Server
AmazonS3
x-amz-request-id
057WWZZH4903YJ4Z
ETag
"91e42db1c66c0b276abf6234dc50b2eb"
Content-Type
image/png
Cache-Control
no-store
Accept-Ranges
bytes
Content-Length
68
x-amz-id-2
4/X8JKPdJHaBHSI0oD/PyzSscKw7FGIABVUDnwg2VEBzks0/S/zZc8U0CHeA4Khx2GTYVJx61Cn1Q4CnW70bXZ+BjkXC/6NffF09CG6npdk=
b
sb.scorecardresearch.com/ 		0
320 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b?c1=7&c2=34354936&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1687290279133&ns_c=UTF-8&c3=1&gdpr=0&gdpr_p1t=&gdpr_li=&gdpr_purps=&gdpr_pcc=&cs_cmp_nc=0&cs_cmp_id=279&cs_cmp_sv=1707&cs_cmp_rt=1&c7=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&c8=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&c9=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.35.93.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-41.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 67d3f8867c3d6540e7495f9026c9c57a.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P8
x-amz-cf-id
diqbL7k2I0rvqKEG2BxTlHMsC-mXtTvh5ss5NRHVvSn_08PmWjN6Kg==
x-cache
Miss from cloudfront
UnitFeedManagerDesktop.min.js
vidstat.taboola.com/lite-unit/4.0.3/ 		111 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/lite-unit/4.0.3/UnitFeedManagerDesktop.min.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5d7c5d22a81ee3d27800eb5d20b5f160efb6cf98d51dd1f0cca7485442f2c5f4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 f7a96eacae195ce7e3982601464ebc84.cloudfront.net (CloudFront), 1.1 varnish
content-encoding
gzip
x-amz-cf-pop
YUL62-C2
age
297520
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT
content-length
31102
x-served-by
cache-yul12823-YUL
last-modified
Sat, 17 Jun 2023 09:04:57 GMT
server
AmazonS3
x-timer
S1687290279.240969,VS0,VE0
etag
"435321ac6c80e1f99bad06be26443aea"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
access-control-allow-headers
*
x-amz-cf-id
DJI9H3HB2ZBtlODFjPVGyDvtMp7Sb9id-ET8zNYWgt8gkUOaHGw2dw==
x-cache-hits
38484
pubs-generic
trc.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
429 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/medianewsgroup-mercurynews/log/3/pubs-generic?route=US:US:V&tvi2=4948&lti=deflated&ri=8d085e89d617fae9291e8f1de6452eb6&sd=v2_cfa7831abef4b97bcc73077b9207f316_1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726_1687290278_1687290278_CNawjgYQtdRXGNjj2dKNMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687290278360&d=%7B%22data%22%3A%22%5C%22true%5C%22%22%2C%22type%22%3A%22DEDUP_DEBUG%22%2C%22eventTime%22%3A1687290279240%7D&tim=19%3A44%3A39.241&id=6669&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
10
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish
x-fastly-to-nlb-rtt
9198
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v2
x-served-by
cache-yul12823-YUL
pragma
no-cache
server
nginx
x-timer
S1687290279.324167,VS0,VE10
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
abtests
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
364 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:US:V&tvi2=4948&lti=deflated&ri=8d085e89d617fae9291e8f1de6452eb6&sd=v2_cfa7831abef4b97bcc73077b9207f316_1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726_1687290278_1687290278_CNawjgYQtdRXGNjj2dKNMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687290278360&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22block_clicks_init%22%2C%22type%22%3A%22block-clicks-manager%22%2C%22eventTime%22%3A1687290279248%7D&tim=19%3A44%3A39.249&id=2400&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:39 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
a01201eb-6d43-4f28-a885-d54446312609
track.elissa.myastrology.com/impression/ 		0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.elissa.myastrology.com/impression/a01201eb-6d43-4f28-a885-d54446312609?site=medianewsgroup-mercurynews&site_id=1436213&title=Your+2023+Horoscope+Is+So+Accurate+It+Will+Give+You+Goosebumps&platform=Desktop&campaign_id=25625854&campaign_item_id=3700671945&thumbnail=http%3A%2F%2Fcdn.taboola.com%2Flibtrc%2Fstatic%2Fthumbnails%2F1930d36909c95abf1f3cef41e57cc7a6.jpg&click_id=GiALk-0NU-zcyW6Z49DX8VCBgSirpxrpXpJY7i06Y15g8yCO40oohMD48PeiocHCAQ
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.225.113.174 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-225-113-174.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:39 GMT
cache-control
no-store, no-cache, pre-check=0, post-check=0
server
nginx
expires
Thu, 01 Jan 1970 00:00:00 GMT
f89e1763-220d-4e09-ba69-9e040548fb7a.svg
cdn.taboola.com/static/f8/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/static/f8/f89e1763-220d-4e09-ba69-9e040548fb7a.svg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
39b076e4bb4fab9b8a142499cf6155f8c128464974691a04de7e764f71b72618

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
cMrDKn.emLmm9kiiOOF64ulDT4DRy6LK
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:39 GMT
x-amz-request-id
1WXHZHV9CYFTY3ST
age
27
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
1758
x-amz-id-2
bUPdSs4j+mPoZz3Ml6xJTa9yKEZ2BgGVNNlpevohzqj538r2xWRaj77or1rkPi+p3r0JnMyGX4E=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 07 Feb 2018 11:15:52 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290279.355181,VS0,VE0
etag
"b8b410e4b18d45aa2f3d9bc09cd335fb"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/svg+xml
access-control-allow-origin
*
abp
19
cache-control
private,max-age=31536000
accept-ranges
bytes
access-control-allow-headers
*
x-cache-hits
43
207
a869.mercurynews.com/DG/DEFAULT/rest/rpc/ 		11 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/DG/DEFAULT/rest/rpc/207?referer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bcsessionid=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&bctempid=&overruleReferrer=&time=2023-06-20T19%3A44%3A39%2B00%3A00&ts=1687290279387
Requested by
Host: a869.mercurynews.com
URL: https://a869.mercurynews.com/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
d093427c28f9036fa0ce26754e136ea10e19760cd1914e61bf5c92b3d400f06d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
2690
x-xss-protection
1; mode=block
pragma
no-cache
server
-
accept-ch
sec-ch-ua-platform-version
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, no-transform, must-revalidate, private
access-control-allow-credentials
true
x-robots-tag
noindex, nofollow
x-amz-cf-id
EIk_sNQ5ZAWqanP9BJvCxyrWtOuGOZWRhVRQE1TaHxcoTckJ9urxMg==
expires
Thu, 01 Jan 1970 00:00:00 GMT
7e7822eb-7edb-4e94-b39f-9cf8aa1b1e33
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/7e7822eb-7edb-4e94-b39f-9cf8aa1b1e33
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
0a5bbfb1-2bd0-4cc6-bf9f-9a5a8cd4aedd
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/0a5bbfb1-2bd0-4cc6-bf9f-9a5a8cd4aedd
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
8c07470e-9ee8-4d23-b52b-6696580186d8
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/8c07470e-9ee8-4d23-b52b-6696580186d8
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
j
rp4.liadm.com/
Redirect Chain
  • https://rp.liadm.com/j?dtstmp=1687290279473&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-m...
  • https://rp4.liadm.com/j?dtstmp=1687290279473&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-...
48 B
587 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://rp4.liadm.com/j?dtstmp=1687290279473&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjY%3D&n3pc=true
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
52.1.91.70 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-1-91-70.compute-1.amazonaws.com
Software
/
Resource Hash
db1be639c6bb1d11edb8c716a629847c3e0f5492de69797d3619b34ddd34e878
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:40 GMT
x-pixel-event-id
cb726fba-0b5e-4b22-bca8-9854ad33900d
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
strict-transport-security
max-age=31536000; includeSubDomains
x-frame-options
DENY
vary
Origin
content-type
application/json
request-time
0
access-control-allow-origin
null
access-control-allow-credentials
true
trace-id
dfc8b97a4875c227
content-length
48
x-xss-protection
1; mode=block

Redirect headers

date
Tue, 20 Jun 2023 19:44:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
x-content-type-options
nosniff
x-permitted-cross-domain-policies
master-only
x-frame-options
DENY
vary
Origin
location
https://rp4.liadm.com/j?dtstmp=1687290279473&aid=a-04i4&se=e30&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&tna=v2.7.2&pu=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&us_privacy=1---&wpn=lc-bundle&gdpr=0&c=PHRpdGxlPk1lZ2hhbiBNYXJrbGUgZWFybmVkIG1vcmUgdGhhbiBUaGUgV2Vla25kIGZvciAnMTIgaG91cnMgd29yayc6IFNwb3RpZnk8L3RpdGxlPjxtZXRhIG5hbWU9ImRlc2NyaXB0aW9uIiBjb250ZW50PSJNZWdoYW4gTWFya2xlIG9ubHkgcHJvZHVjZWQgMTIgaG91cnMgb2YgcG9kY2FzdCBjb250ZW50IGluIDLCvSB5ZWFycywgeWV0IHBvc3NpYmx5IGVhcm5lZCBtb3JlIHRoYW4gVGhlIFdlZWtuZCBmb3IgaGlzIGh1Z2UgaGl0ICdCbGluZGluZyBMaWdodHMuJyI-PGxpbmsgcmVsPSJjYW5vbmljYWwiIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy8iPjxoMSBjbGFzcz0ic2VjdGlvbi1oZWFkZXIiPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQ8L2E-PC9oMT48aDEgY2xhc3M9ImVudHJ5LXRpdGxlIj4KCjxkaXYgY2xhc3M9ImVudHJ5LXNlY3Rpb24iPjxhIGhyZWY9Imh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC8iPkVudGVydGFpbm1lbnQgfCA8L2E-PC9kaXY-CQoJCQkJPHNwYW4gY2xhc3M9ImRmbS10aXRsZSBmcmVlIj4KCQkJTWVnaGFuIE1hcmtsZSBlYXJuZWQgbW9yZSB0aGFuIFRoZSBXZWVrbmQgZm9yIGp1c3Qg4oCYMTIgaG91cnMgd29yayzigJkgZXgtU3BvdGlmeSBleGVjIHRlbGxzIEJCQwkJPC9zcGFuPgoKCQoJPC9oMT4&i6=MjYwNzo1MzAwOjYwOjc4Njc6OjY%3D&n3pc=true
access-control-allow-origin
https://www.mercurynews.com
request-time
0
access-control-allow-credentials
true
trace-id
b64836c893b84ed7
content-length
0
x-xss-protection
1; mode=block
7cHqv4kjgoGqM7E3_-gs51os.woff2
fonts.gstatic.com/s/barlow/v12/ Frame D961 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v12/7cHqv4kjgoGqM7E3_-gs51os.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 17:16:40 GMT
x-content-type-options
nosniff
age
268079
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20960
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:18:28 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 17:16:40 GMT
7cHpv4kjgoGqM7E_DMs5.woff2
fonts.gstatic.com/s/barlow/v12/ Frame D961 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/barlow/v12/7cHpv4kjgoGqM7E_DMs5.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Barlow:wght@400;500;600&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 17 Jun 2023 08:12:48 GMT
x-content-type-options
nosniff
age
300711
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
21144
x-xss-protection
0
last-modified
Tue, 19 Apr 2022 19:43:23 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 16 Jun 2024 08:12:48 GMT
social
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
363 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/social?route=US:US:V&tvi2=4948&lti=deflated&ri=8d085e89d617fae9291e8f1de6452eb6&sd=v2_cfa7831abef4b97bcc73077b9207f316_1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726_1687290278_1687290278_CNawjgYQtdRXGNjj2dKNMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687290278360&st=social-available&d=%7B%22data%22%3A%5B%7B%22i%22%3A%22ctx%22%2C%22ism%22%3Afalse%2C%22srx%22%3A1600%2C%22sry%22%3A1200%2C%22pd%22%3Anull%2C%22tpl%22%3A%22%22%2C%22url%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%22%2C%22rref%22%3A%22%22%2C%22sref%22%3A%22_sessionPending_%22%2C%22hdl%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%E2%80%99%20ex-Spotify%20exec%20tells%20BBC%22%2C%22sec%22%3A%22Entertainment%22%2C%22aut%22%3A%5B%22Martha%20Ross%22%5D%2C%22img%22%3A%22https%3A%2F%2Fwww.mercurynews.com%2Fwp-content%2Fuploads%2F2023%2F03%2FBritain_Royals_03732-1.jpg%3Fw%3D1024%22%2C%22v%22%3A15%2C%22pw%22%3Afalse%7D%5D%7D&tim=19%3A44%3A39.485&id=6732&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:39 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
2f9f63ce5348f9eb1bedb736d7977b6f.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/2f9f63ce5348f9eb1bedb736d7977b6f.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f90b7e728b81ac33ca70ffad5f9e7f0eeb9e834a03d79b8e275ddfcfba0c79c1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/2f9f63ce5348f9eb1bedb736d7977b6f.jpg
age
1207293
edge-cache-tag
558043294964953113580507800799300959048,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
558043294964953113580507800799300959048,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
196
expiration
expiry-date="Tue, 13 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.tipranks.com/
content-length
13032
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb204
x-served-by
cache-iad-kjyo7100155-IAD, cache-iad-kjyo7100037-IAD, cache-sna10747-LGB, cache-iad-kjyo7100148-IAD, cache-yul12823-YUL
last-modified
Sat, 13 May 2023 05:16:48 GMT
server
nginx
x-timer
S1687290280.511846,VS0,VE1
etag
"5c799890dce879b537a44d664f66ba4b"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 0, 0, 16, 1
f079f33a8821cf38e86b2fd73f202402.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f079f33a8821cf38e86b2fd73f202402.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5b0e52f0010ddd9cedbd18501653235b15aaf7ae8fcd01f75978940f33b82f80

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/f079f33a8821cf38e86b2fd73f202402.jpg
age
2476473
edge-cache-tag
585584427760933062666737402267197888241,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
585584427760933062666737402267197888241,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
51
expiration
expiry-date="Thu, 08 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.espn.com/
content-length
9424
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb802
x-served-by
cache-iad-kiad7000035-IAD, cache-iad-kiad7000158-IAD, cache-lga21934-LGA, cache-iad-kcgs7200098-IAD, cache-yul12823-YUL
last-modified
Mon, 08 May 2023 23:20:42 GMT
server
nginx
x-timer
S1687290280.520281,VS0,VE1
etag
"1624048ef0a5dc9ab11cfc7a2acbff2e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 0, 399, 1
a90899e84e5b40721594b8ba7517e0cd.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a90899e84e5b40721594b8ba7517e0cd.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
83ae7ba0370974e803fb70ffffd92deb797d08198ed6310e207ba7d75b72029e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/a90899e84e5b40721594b8ba7517e0cd.jpeg
age
2442421
edge-cache-tag
485668035201530982018547323808119286028,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
485668035201530982018547323808119286028,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
HIT, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
107
req-referer
https://www.harpersbazaar.com/
content-length
17756
x-request-id
42dbadf70dd009b0df5585bf132a5dd7
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb804
x-served-by
cache-iad-kiad7000102-IAD, cache-iad-kcgs7200112-IAD, cache-chi-klot8100091-CHI, cache-iad-kiad7000063-IAD, cache-yul12823-YUL
last-modified
Fri, 05 May 2023 19:50:25 GMT
server
nginx
x-timer
S1687290280.522772,VS0,VE0
etag
"6ff1e84f0dafe001ea5f5047e2457782"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 0, 234, 60
1791c9fa81a2a54a4641becd20be4b3e.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1791c9fa81a2a54a4641becd20be4b3e.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b5d6afdc43eb876b18c0a4ff25f6d2cd305f03a8970e3134e00670b707afa463

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1791c9fa81a2a54a4641becd20be4b3e.jpg
age
1845504
edge-cache-tag
402188373656136331886263197554274643949,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
402188373656136331886263197554274643949,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
126
expiration
expiry-date="Fri, 16 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://en.newsner.com/
content-length
12280
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb802
x-served-by
cache-iad-kiad7000125-IAD, cache-iad-kcgs7200170-IAD, cache-chi-klot8100171-CHI, cache-iad-kiad7000020-IAD, cache-yul12823-YUL
last-modified
Tue, 16 May 2023 08:35:35 GMT
server
nginx
x-timer
S1687290280.526092,VS0,VE0
etag
"4149128e15c9eb101392d0f64f1c8cee"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1, 2061, 6
9cc7eaf84d81d0a5a57cf79b8cf401f1.jpeg
images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_720,y_557/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_720,y_557/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9cc7eaf84d81d0a5a57cf79b8cf401f1.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
146ce9984266770e5e96199e4e59ca1fb5fede14f70758bcbf87654dac300667

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_720,y_557/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9cc7eaf84d81d0a5a57cf79b8cf401f1.jpeg
age
1000224
edge-cache-tag
423741170203452711613019170260913585729,371972016300049567560374894438402955629,29ecf9b93bbf306179626feeda1fab70
cache-tag
423741170203452711613019170260913585729,371972016300049567560374894438402955629,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
50
expiration
expiry-date="Tue, 13 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.space.com/
content-length
24982
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200143-IAD, cache-iad-kiad7000149-IAD, cache-sna10728-LGB, cache-iad-kjyo7100155-IAD, cache-yul12823-YUL
last-modified
Sat, 13 May 2023 04:37:21 GMT
server
nginx
x-timer
S1687290280.527028,VS0,VE0
etag
"a9100cb9e9459aa85ec807d59901a495"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 17185, 23
41706383c04e2d2707bba90e13cbfe8c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/41706383c04e2d2707bba90e13cbfe8c.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
74c0349fc386a4f27375a8f7f98c7867ce1f72ba65b9f040993a2bc8c6229ed0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/41706383c04e2d2707bba90e13cbfe8c.jpg
age
619629
edge-cache-tag
319057017648119700857710964196482850322,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
319057017648119700857710964196482850322,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
220
expiration
expiry-date="Thu, 15 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.cnbctv18.com/
content-length
13770
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb803
x-served-by
cache-iad-kjyo7100055-IAD, cache-iad-kiad7000054-IAD, cache-lga21923-LGA, cache-iad-kjyo7100147-IAD, cache-yul12823-YUL
last-modified
Mon, 15 May 2023 12:15:39 GMT
server
nginx
x-timer
S1687290280.527153,VS0,VE0
etag
"6716af523c1693593f40d03b019d2f61"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 11, 2
bd1077109a793004d789267b56de3e3b.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		26 KB
27 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bd1077109a793004d789267b56de3e3b.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
141edd521ee7dc499dfaaa8b9cebd09a7be6cba128d788b5a5388232eeabc462

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bd1077109a793004d789267b56de3e3b.jpg
age
5042937
edge-cache-tag
529596858949551976325957996360154879293,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
529596858949551976325957996360154879293,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
35
expiration
expiry-date="Tue, 25 Apr 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.pronews.gr/
content-length
26506
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kiad7000101-IAD, cache-iad-kiad7000091-IAD, cache-lax10624-LGB, cache-iad-kjyo7100073-IAD, cache-yul12823-YUL
last-modified
Sat, 25 Mar 2023 01:56:33 GMT
server
nginx
x-timer
S1687290280.527629,VS0,VE0
etag
"40e3a0665aff5f0cab6d04cba1f14d6f"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 1, 3075, 12
1930d36909c95abf1f3cef41e57cc7a6.jpg
images.taboola.com/taboola/image/fetch/h_212,w_380,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/h_212,w_380,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1930d36909c95abf1f3cef41e57cc7a6.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
2f8d80d02c9817b240d7a7e01ff520bcd4babcb3fcaaa662c9cf0677d0551a44

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/h_212,w_380,c_pad,b_auto/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1930d36909c95abf1f3cef41e57cc7a6.jpg
age
5633179
edge-cache-tag
528740734448106871236160004259463905985,348889382464176146727401345046071238748,29ecf9b93bbf306179626feeda1fab70
cache-tag
528740734448106871236160004259463905985,348889382464176146727401345046071238748,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
93
expiration
expiry-date="Wed, 10 May 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://games.espn.com/
content-length
20830
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb204
x-served-by
cache-iad-kjyo7100147-IAD, cache-iad-kiad7000092-IAD, cache-lax10657-LGB, cache-iad-kiad7000154-IAD, cache-yul12823-YUL
last-modified
Sun, 09 Apr 2023 13:40:41 GMT
server
nginx
x-timer
S1687290280.536525,VS0,VE1
etag
"ac83969e6029d6c15ee8e7bd2fea5031"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 2, 0, 641, 1
c6239d26c1081015da8050230fbf269b.jpg
images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_362,y_230/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		46 KB
47 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_362,y_230/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6239d26c1081015da8050230fbf269b.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ae7035fc79c92988ad3abf6bbcd7fffb307e0e5c76c140efe0b899bd4380bfb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_362,y_230/http%3A//cdn.taboola.com/libtrc/static/thumbnails/c6239d26c1081015da8050230fbf269b.jpg
age
3663568
edge-cache-tag
587356268005097457686237049894664356422,593926418681870691671074173605565287936,29ecf9b93bbf306179626feeda1fab70
cache-tag
587356268005097457686237049894664356422,593926418681870691671074173605565287936,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
314
expiration
expiry-date="Fri, 02 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.lowellsun.com/
content-length
46942
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200153-IAD, cache-iad-kjyo7100124-IAD, cache-lax10631-LGB, cache-iad-kcgs7200149-IAD, cache-yul12823-YUL
last-modified
Tue, 02 May 2023 10:53:40 GMT
server
nginx
x-timer
S1687290280.536499,VS0,VE0
etag
"010062a068dabb08a700500d96dc19d0"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 1757, 1129
08d35ed35e50878d84df147e26849429.jpeg
images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_848,y_408/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		35 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_848,y_408/http%3A//cdn.taboola.com/libtrc/static/thumbnails/08d35ed35e50878d84df147e26849429.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
730e5d8dcd90d9cf4691585f963626ab7460d8f1d6e7cffd79e9437311c21ff7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/h_323,w_580,c_fill,g_xy_center,x_848,y_408/http%3A//cdn.taboola.com/libtrc/static/thumbnails/08d35ed35e50878d84df147e26849429.jpeg
age
976286
edge-cache-tag
602040619135428528114518396467040421338,502757768743626974269722491078465593063,29ecf9b93bbf306179626feeda1fab70
cache-tag
602040619135428528114518396467040421338,502757768743626974269722491078465593063,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
186
expiration
expiry-date="Sat, 08 Jul 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.telesurenglish.net/
content-length
36312
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kjyo7100050-IAD, cache-iad-kjyo7100105-IAD, cache-sna10747-LGB, cache-iad-kiad7000086-IAD, cache-yul12823-YUL
last-modified
Wed, 07 Jun 2023 22:32:29 GMT
server
nginx
x-timer
S1687290280.542252,VS0,VE0
etag
"d414677590d97c16230e8f43f089d004"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 265, 2
5f6934464b889cb70e776163421cad14.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5f6934464b889cb70e776163421cad14.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c45f77ccf825ed595a9da96ff8d103bf9da0290d1e1171a2f196da6291aa449c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/5f6934464b889cb70e776163421cad14.jpg
age
1853227
edge-cache-tag
314913709222735986141388269769472855185,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
314913709222735986141388269769472855185,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
67
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.oneidadispatch.com/
content-length
13516
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200177-IAD, cache-iad-kjyo7100144-IAD, cache-lax10648-LGB, cache-iad-kiad7000081-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 17:23:27 GMT
server
nginx
x-timer
S1687290280.542428,VS0,VE1
etag
"63a99db1245af4f719d7689157e0504e"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 947, 1
b8f6b00ccd9f8bdd40a4cdfec7451281.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b8f6b00ccd9f8bdd40a4cdfec7451281.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4c240c4ac6e19ba6374608ca86e43c632814c2666a3d0fbcff7a73303624b414

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/b8f6b00ccd9f8bdd40a4cdfec7451281.png
age
3638997
edge-cache-tag
469016235849824144393142959782476520571,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
469016235849824144393142959782476520571,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
159
expiration
expiry-date="Sun, 21 May 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.levante-emv.com/tendencias21/2022/05/25/astronautas-visitaran-marte-durante-mes-66518289.html
content-length
16498
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb802
x-served-by
cache-iad-kjyo7100076-IAD, cache-iad-kcgs7200030-IAD, cache-lga21932-LGA, cache-iad-kiad7000065-IAD, cache-yul12823-YUL
last-modified
Thu, 20 Apr 2023 05:25:36 GMT
server
nginx
x-timer
S1687290280.542851,VS0,VE0
etag
"ddc8b1826cf14f366b2b9e98f4b43fc2"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 2674, 2
20ca3920796705f4e953bd5014720ea9.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/20ca3920796705f4e953bd5014720ea9.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
df3ac0dbcf2d632d347eedf170353a58fe7d9b6076fea9394ad9858a38b49bd9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/20ca3920796705f4e953bd5014720ea9.jpg
age
852899
edge-cache-tag
302935950058188571201508857327343714482,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
302935950058188571201508857327343714482,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
147
req-referer
https://www.ynet.co.il/
content-length
18244
x-request-id
fe470abf889f8da8ecedf262e1fb1905
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kcgs7200101-IAD, cache-iad-kjyo7100138-IAD, cache-lga21957-LGA, cache-iad-kiad7000071-IAD, cache-yul12823-YUL
last-modified
Tue, 06 Jun 2023 21:19:10 GMT
server
nginx
x-timer
S1687290280.542626,VS0,VE0
etag
"fcb423af1dac8b131c33181f489d7a22"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 0, 9546, 127
AffleckLopez1.jpg%3Fw%3D1024%26h%3D751
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/05/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/05/AffleckLopez1.jpg%3Fw%3D1024%26h%3D751
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
627a616d9b01ee3678ceb7b6cf9d425c6016b479f39b5cac5288c3096c7028a2

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/05/AffleckLopez1.jpg%3Fw%3D1024%26h%3D751
age
2609868
edge-cache-tag
324295795619022846022250670787859467832,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
324295795619022846022250670787859467832,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
96
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.mercurynews.com/
content-length
22034
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kiad7000028-IAD, cache-iad-kjyo7100131-IAD, cache-sna10743-LGB, cache-iad-kiad7000117-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 20:55:39 GMT
server
nginx
x-timer
S1687290280.550867,VS0,VE1
etag
"26a4336c6a977552f6160d8884559552"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 3, 1, 1128, 1
6bbf78d9-7c67-4944-bbc7-d68896931228
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/6bbf78d9-7c67-4944-bbc7-d68896931228
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
KevinCostnerWife.jpg%3Fw%3D1024%26h%3D694
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/06/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/06/KevinCostnerWife.jpg%3Fw%3D1024%26h%3D694
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c60110236e57f0f952ff51681881465e3652e17baa1b702737c53f57ef5c2bd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
2
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2023/06/KevinCostnerWife.jpg%3Fw%3D1024%26h%3D694
age
17193
edge-cache-tag
400092526256972483765743448021532455327,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
400092526256972483765743448021532455327,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
109
req-referer
https://www.mercurynews.com/
content-length
13792
x-request-id
51782c61a6f5611f7d72ce34c0370428
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200089-IAD, cache-iad-kiad7000088-IAD, cache-lax10648-LGB, cache-iad-kjyo7100044-IAD, cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 14:53:44 GMT
server
nginx
x-timer
S1687290280.551261,VS0,VE2
etag
"3234af944fb2518fe78de12aeb764882"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 28, 1
960f9b928d7d068f84e487ef6145960a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/960f9b928d7d068f84e487ef6145960a.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b0d0d8d4d905ad8cf5c26b2f074de1b2ad84074a222065a512f51b3298494371

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/960f9b928d7d068f84e487ef6145960a.jpg
age
374644
edge-cache-tag
430444656904844161219105173073324637324,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
430444656904844161219105173073324637324,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
153
expiration
expiry-date="Wed, 21 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.semana.com/
content-length
9128
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kcgs7200052-IAD, cache-iad-kiad7000118-IAD, cache-chi-klot8100038-CHI, cache-iad-kiad7000120-IAD, cache-yul12823-YUL
last-modified
Sun, 21 May 2023 00:50:34 GMT
server
nginx
x-timer
S1687290280.558777,VS0,VE0
etag
"30bf1d1f5bce1e27966db97d1d475ff8"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 2966, 5
93e7c6c4a868985cdb71cb3ccf707499.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/93e7c6c4a868985cdb71cb3ccf707499.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dd76966336047650cefcf04deb9fa6109be2943b6c5c5fae4ee733238ad6f281

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/93e7c6c4a868985cdb71cb3ccf707499.jpeg
age
3311354
edge-cache-tag
609363502349849483221139673788325806102,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
609363502349849483221139673788325806102,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
49
req-referer
http://www.espn.com/
content-length
15714
x-request-id
869152c016cc14f42d054a1dc1a1dea5
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb801
x-served-by
cache-iad-kcgs7200073-IAD, cache-iad-kcgs7200176-IAD, cache-chi-klot8100179-CHI, cache-iad-kjyo7100076-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 15:02:01 GMT
server
nginx
x-timer
S1687290280.559680,VS0,VE0
etag
"5c50962e3b89d112968a3dc54697395d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 3, 1, 27516, 1001
d8d9fe042eb35785ca820adce0d4504c.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d8d9fe042eb35785ca820adce0d4504c.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
752cb6627738044d241aea7470759409cd69b5d7d639d298b065ad601f304ca4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d8d9fe042eb35785ca820adce0d4504c.jpg
age
1241033
edge-cache-tag
372912748934979544711820844785966957671,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
372912748934979544711820844785966957671,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, MISS, HIT, HIT
x-envoy-upstream-service-time
428
req-referer
https://www.dinamalar.com/
content-length
5282
x-request-id
21bb398500a2abfe96f9d2bc609f4f82
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb803
x-served-by
cache-iad-kiad7000041-IAD, cache-iad-kcgs7200110-IAD, cache-chi-kigq8000102-CHI, cache-iad-kiad7000165-IAD, cache-yul12823-YUL
last-modified
Mon, 05 Jun 2023 03:00:46 GMT
server
nginx
x-timer
S1687290280.558801,VS0,VE0
etag
"f1a363c767120d8a9ad4e91d9bdd1e2d"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 0, 164, 3
4431b031b6fb1944bd6422ab189c3c7a.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4431b031b6fb1944bd6422ab189c3c7a.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
471eefabc0980475d6623b341a79bc4971b0cd760a87e80b5424eb52048a5432

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4431b031b6fb1944bd6422ab189c3c7a.png
age
1934165
edge-cache-tag
403149618732190404586841115889746597861,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
cache-tag
403149618732190404586841115889746597861,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
187
req-referer
https://www.sport.es/
content-length
15380
x-request-id
7ef3929500937e897ab7427af9198423
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb201
x-served-by
cache-iad-kjyo7100078-IAD, cache-iad-kiad7000041-IAD, cache-lax10639-LGB, cache-iad-kiad7000081-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 23:49:10 GMT
server
nginx
x-timer
S1687290280.559203,VS0,VE0
etag
"b016ffe32dc9d48c03968b52340615cb"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1, 84, 519
1043266802__OueLhze2.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/1043266802__OueLhze2.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9aba16a6f98130875d5393a65f1975708a4a7a55a20edc943b679eabac02bf7b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/SKP/1043266802__OueLhze2.jpg
age
1075351
edge-cache-tag
469570300027794231975039569860978569601,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
cache-tag
469570300027794231975039569860978569601,335123382593109332920738240433639299042,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
HIT, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
97
req-referer
https://www.sciencealert.com/
content-length
11460
x-request-id
e5f0f42865f3282de9915dbe7c37e87f
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb202
x-served-by
cache-iad-kcgs7200062-IAD, cache-iad-kcgs7200105-IAD, cache-sna10743-LGB, cache-iad-kiad7000082-IAD, cache-yul12823-YUL
last-modified
Sun, 04 Jun 2023 19:41:19 GMT
server
nginx
x-timer
S1687290280.565602,VS0,VE1
etag
"d884e9d0305f1435f1cc1f8c10da2c88"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 0, 1, 540, 1
harriet1500px.jpg%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/harriet1500px.jpg%3Fw%3D1024%26h%3D614
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
551f890cd0db913ed40a3d0e792eb91af7f8281d91314ed16ad3cb6a5ccb4b61

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/harriet1500px.jpg%3Fw%3D1024%26h%3D614
age
1593745
edge-cache-tag
395526842995013890152543120513637345232,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
395526842995013890152543120513637345232,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
125
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.mercurynews.com/
content-length
8874
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb204
x-served-by
cache-iad-kiad7000142-IAD, cache-iad-kjyo7100076-IAD, cache-sna10729-LGB, cache-iad-kjyo7100119-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 18:44:45 GMT
server
nginx
x-timer
S1687290280.565586,VS0,VE1
etag
"ecb44a39dbccfd67de72511a7c59e73b"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1, 502, 1
abby1500px.jpg%3Fw%3D1024%26h%3D614
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/abby1500px.jpg%3Fw%3D1024%26h%3D614
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
05486206a996712b904973ec59a3f5c2aa84eb26bf6e739c7275e7b59731653d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_323%2Cw_580%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//www.mercurynews.com/wp-content/uploads/2022/05/abby1500px.jpg%3Fw%3D1024%26h%3D614
age
2591924
edge-cache-tag
599327998133654055158422142444566160912,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
599327998133654055158422142444566160912,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, HIT, HIT, HIT, HIT
x-envoy-upstream-service-time
107
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://d-21537643091222791577.ampproject.net/
content-length
5502
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb804
x-served-by
cache-iad-kiad7000089-IAD, cache-iad-kjyo7100147-IAD, cache-chi-kigq8000104-CHI, cache-iad-kjyo7100070-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 19:58:36 GMT
server
nginx
x-timer
S1687290280.573385,VS0,VE1
etag
"8bb8871d839ff267f6b5504ea320ddb3"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1, 3172, 1
458944fb-699e-41ce-a9be-961099cb071f
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/458944fb-699e-41ce-a9be-961099cb071f
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
b94d9aca-fb0a-4395-b3e3-bab63113a801
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/b94d9aca-fb0a-4395-b3e3-bab63113a801
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
98bdb14d-51f3-4691-b25d-8720ed8d9e72
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/98bdb14d-51f3-4691-b25d-8720ed8d9e72
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
3076bce138f3299ef6abd10ad017afb3.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3076bce138f3299ef6abd10ad017afb3.jpeg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c1a002e1c66e42dfb20cb146829687f9c5f07d76da85a5611307f3f1f67a8199

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3076bce138f3299ef6abd10ad017afb3.jpeg
age
3498211
edge-cache-tag
438901447660464684095524351628620087875,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
cache-tag
438901447660464684095524351628620087875,309727233042263395173288000816347086757,29ecf9b93bbf306179626feeda1fab70
x-cache
HIT, HIT, MISS, HIT, HIT
x-envoy-upstream-service-time
80
expiration
expiry-date="Mon, 15 May 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.worldjournal.com/
content-length
10388
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb203
x-served-by
cache-iad-kjyo7100121-IAD, cache-iad-kcgs7200178-IAD, cache-lax10645-LGB, cache-iad-kjyo7100115-IAD, cache-yul12823-YUL
last-modified
Fri, 14 Apr 2023 15:44:52 GMT
server
nginx
x-timer
S1687290280.573377,VS0,VE0
etag
"64021491a0da10b35e6ceb14ae720773"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 2, 0, 10062, 17
3b9c1aff23312afd0d184e0f54179765.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b9c1aff23312afd0d184e0f54179765.jpg
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
8685554b355858b7ad6e0bc503213f89d6612b378719637bd032bf3912d1e79f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/3b9c1aff23312afd0d184e0f54179765.jpg
age
2616573
edge-cache-tag
472722463543017882621331439693518864511,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
472722463543017882621331439693518864511,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
96
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://www.eastbaytimes.com/
content-length
10628
x-backend-name
CH_DIR:3FP7YNX3LMizprTZsG7BSW--F_CH_nlb803
x-served-by
cache-iad-kiad7000027-IAD, cache-iad-kiad7000102-IAD, cache-lga21945-LGA, cache-iad-kcgs7200106-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 18:13:25 GMT
server
nginx
x-timer
S1687290280.573369,VS0,VE0
etag
"151e9055f4c3189ca9ba53642e685f1c"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 1327, 32
Fliesen.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//content-cdn.tippsundtricks.co/2017/03/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//content-cdn.tippsundtricks.co/2017/03/Fliesen.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
09b6e418da68639208bd22fc77a5467dc6a6235d1eaacf70e6d4b7c739257f94

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish, 1.1 varnish
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_212%2Cw_380%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//content-cdn.tippsundtricks.co/2017/03/Fliesen.png
age
1227467
edge-cache-tag
624237704448984462090471028767463012506,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
cache-tag
624237704448984462090471028767463012506,542123104031085224879637386283300440882,29ecf9b93bbf306179626feeda1fab70
x-cache
MISS, MISS, HIT, HIT, HIT
x-envoy-upstream-service-time
102
expiration
expiry-date="Sun, 11 Jun 2023 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
req-referer
https://d-9761110752099004951.ampproject.net/
content-length
24370
x-backend-name
LA_DIR:3FP7YNX3LMizprTZsG7BSW--F_LA_nlb204
x-served-by
cache-iad-kiad7000052-IAD, cache-iad-kiad7000178-IAD, cache-sna10724-LGB, cache-iad-kiad7000080-IAD, cache-yul12823-YUL
last-modified
Thu, 11 May 2023 20:25:56 GMT
server
nginx
x-timer
S1687290280.573780,VS0,VE1
etag
"15d2d30ac846b0d983934867e30f5f26"
x-ratelimit-remaining
100
vary
ImageFormat
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-ratelimit-reset
1
x-ratelimit-limit
101
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1, 881, 1
t
jadserve.postrelease.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ntv_mvi&us_privacy=1---
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.210.36.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-210-36-192.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
ad682af386ad4c5c4ef835159d4fbcfc30638462aa4c5d8cfd6b271da5d91d45

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:39 GMT
content-encoding
gzip
server
nginx/1.12.2
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
1520
expires
Mon, 1 Jan 1990 12:00:00 GMT
bat.js
bat.bing.com/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 20 Jun 2023 19:44:38 GMT
last-modified
Thu, 11 May 2023 18:08:27 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: E8710FF3E54E4D47A91DD479DF17527B Ref B: YMQ01EDGE0522 Ref C: 2023-06-20T19:44:39Z
etag
"80df77953384d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12183
pr
s.amazon-adsystem.com/v3/ Frame 73C7 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
0e63b41633f702445beda74ed05507a27af4838c324df394a779c4c823e15f0e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://s.amazon-adsystem.com/iu3?cm3ppd=1&d=dtb-pub&csif=t&gdpr=0&dl=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&dcc=t
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
4110
Content-Type
text/html;charset=ISO-8859-1
Date
Tue, 20 Jun 2023 19:44:39 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
GRC3V0TSMNRS5WCJBNRC
1060502780777063
connect.facebook.net/signals/config/ 		376 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1060502780777063?v=2.9.107&r=stable
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
7c46d9a954829d09583e3af58d09df0ab2773f37dc1e3ad593d382c2234fed47
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:44:39 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
109917
x-xss-protection
0
pragma
public
x-fb-debug
fW9yHFKI2XPcYL/l4Hqyx4qBpiTrUmTMUGS3rMKTB+A9qZENvyvQGQQhmHGJe7lmXpVDEqvOpBR/4MFOqUerCA==
x-fb-trip-id
1679558926
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
debug
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/2/ 		0
89 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/2/debug?tim=19%3A44%3A39.241&type=warn&msg=Duplicated%20items%20monitoring%20enabled&llvl=2&id=8231&cv=20230620-6-RELEASE&lt=deflated&uuid=e22bf1c1c60f682c92f41e6eafaf8e3c7749aad48f7cac628cf2a0c36cc6c104&dcc=1&pcs=%5Bdata-feed-main-container-id%3D%22taboola-below-article-thumbnails%22%5D&vi=1687290278360
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27958
djxmvumgbmaplf92fmho.mp4
cdn.taboola.com/libtrc/static/video/v1679570880/ 		465 KB
465 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1679570880/djxmvumgbmaplf92fmho.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a033870063ffdcdc1b7842eec37e0e5ab4a66f5d0788eef0bea2f710b1c3c0d5

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
HBi6suhi.hwH.ILTTagPF3huf2AQDLFJ
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish
x-amz-request-id
WZS0037Z85V7Z06E
age
79
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-476104/476105
x-amz-replication-status
COMPLETED
Content-Length
476105
x-amz-id-2
XPWOSg2KcPG8wh9pCbZw/tUOJoPhMZN0lGOv0ISSsi5X5MFvBDKBUIROeTENqQSkH5VWzwrsz2Q=
x-served-by
cache-yul12823-YUL
last-modified
Thu, 23 Mar 2023 11:28:08 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.646318,VS0,VE10
etag
"7f2d130be8734a174428106a856a5517"
content-type
video/mp4;codecs=avc1
abp
16
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
hhmin4panzq32yprgu70.mp4
cdn.taboola.com/libtrc/static/video/v1670403161/ 		227 KB
227 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1670403161/hhmin4panzq32yprgu70.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2f092f236f905de588f781555bffe9b9fba9e85a3bb451441ca86fd8ef9a01ff

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
s1mLEVq22HiI9F7ZGwjPUpMskS_LfNnh
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish
x-amz-request-id
WQ2W3XM3TPS6YQPJ
age
71
x-cache
HIT
Content-Range
bytes 0-232274/232275
x-amz-replication-status
COMPLETED
Content-Length
232275
x-amz-id-2
IcpvFUz0PUdHg0hxuNwoP9jgZ7C7Tz3ljy5ynQbBz8H9/O/q6pLE9HwUbzNv8A9SZZkHrLIbEck=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 07 Dec 2022 08:52:46 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.647293,VS0,VE1
etag
"512c3d32954a5623da5f98b4c4e550e0"
content-type
video/mp4;codecs=avc1
abp
55
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
jfy5yp77cohy74fsw5uk.mp4
cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/ 		67 KB
67 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/jfy5yp77cohy74fsw5uk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5af7f54e4682da1be1484f658f9b15a84537085a4081cef229704a6d8e4ceb71

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
JhpPlUz7nZ57ILPZKofZM6pneMKKR0I4
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish
x-amz-request-id
D3FA3P6X7SQ7DC27
age
86
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-68339/68340
x-amz-replication-status
COMPLETED
Content-Length
68340
x-amz-id-2
eJPfgBRMRFaaYjnMKEy2osdHu6mWqmpQFIXTxUgQkkLIfK6wRnJnYXH1qN43RrKSoemeezPPN9w=
x-served-by
cache-yul12823-YUL
last-modified
Fri, 03 Feb 2023 08:45:58 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.649360,VS0,VE1
etag
"12d66db772be5305a2eda235f0b44b99"
content-type
video/mp4;codecs=avc1
abp
82
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
dnbksjfr9whkc3iezepw.mp4
cdn.taboola.com/libtrc/static/video/v1651669819/ 		247 KB
248 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1651669819/dnbksjfr9whkc3iezepw.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b2ac16b228712faf976cdd913df75af40fd04cb4377808ce7f5d9ac091303592

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
TpyK5tKmV6zFQiNaY6BO7yl1WPpuDgHz
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish
x-amz-request-id
YRP5SW4SZNMW18Z9
age
15
x-cache
HIT
Content-Range
bytes 0-253403/253404
x-amz-replication-status
COMPLETED
Content-Length
253404
x-amz-id-2
JfNWeIG1wv5k5xBdWDvW947i0fb4ByY/ZAH1khMaoEXXmS+vYJk8DgrRo1IID1fpIYywtzLVpOE=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 04 May 2022 13:10:25 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.650983,VS0,VE1
etag
"dcbb2da1ae87141fc4afaec988a228ad"
content-type
video/mp4;codecs=avc1
abp
51
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
cktcnyyudrurusyfjouk.mp4
cdn.taboola.com/libtrc/static/video/v1685950230/ 		1 MB
1 MB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1685950230/cktcnyyudrurusyfjouk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7a6e593f715545a4262c0d9a90d157b6b18ae0900ca6ddf3c6d568134310fc2f

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
d6ueGktFcB2EwN7zocuabc2gAAuw1YPA
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish
x-amz-request-id
QF7J1Y53HJS926GS
age
41
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-1248084/1248085
x-amz-replication-status
COMPLETED
Content-Length
1248085
x-amz-id-2
AdisWrdtRQdFmzLV3/61Tb4gSYFRPu6s+oI+p/lCbUUx3WIbXNg316yBk1w8PkwZILDvBb78qKU=
x-served-by
cache-yul12823-YUL
last-modified
Mon, 05 Jun 2023 07:30:39 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.653276,VS0,VE1
etag
"e73e901218df8f12f0d31914663c3397"
content-type
video/mp4;codecs=avc1
abp
22
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
ae0ue1jbcjqu5byivgsm.mp4
cdn.taboola.com/libtrc/static/video/v1682562179/ 		463 KB
463 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1682562179/ae0ue1jbcjqu5byivgsm.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
03d9c6282533912a324c1d6f7c0c06583bed3f2c3a4a2331a6c36df3602faf52

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
1kIG7nplrGZPIHeqvx4bs.wW29YRS385
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish
x-amz-request-id
DA2E1JF243MYTFAP
age
111
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-474042/474043
x-amz-replication-status
COMPLETED
Content-Length
474043
x-amz-id-2
tDZ397Boo/58rYdcxjTgy7+Sezl//JOwq9xnMDPTZaYRZL7sCEeg9NuBgxAeK+DC4jQRlMZulr8=
x-served-by
cache-yul12823-YUL
last-modified
Thu, 27 Apr 2023 02:23:05 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.662465,VS0,VE1
etag
"f3a359ea66d151486ab4c08935a18108"
content-type
video/mp4;codecs=avc1
abp
97
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
fo1n9cyehn4udxz1pco5.mp4
cdn.taboola.com/libtrc/static/video/t_PERFORMANCE_VIDEO_DEFAULT/v1624356367/ 		758 KB
759 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/t_PERFORMANCE_VIDEO_DEFAULT/v1624356367/fo1n9cyehn4udxz1pco5.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eae680a0310650963eb8117946e1b91a75a1e2889b547572e2624aba3afbc3eb

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
EbhNmp3yB2TBCvlVWv.7CzZBqFnFkb3C
date
Tue, 20 Jun 2023 19:44:39 GMT
via
1.1 varnish
x-amz-request-id
44V53R7Z6X6XTDCX
age
7
x-cache
HIT
Content-Range
bytes 0-776169/776170
x-amz-replication-status
COMPLETED
Content-Length
776170
x-amz-id-2
2gL2QcxOXkZQDqfru3izsPomTRx58PrF1Ac/cD0wlR+urYE4+UoyrGoPIlu/I8MJZdNk4XthcV8=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 22 Jun 2021 10:06:42 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.664653,VS0,VE1
etag
"10f38704cb7da976bf646d36d8f12f73"
content-type
video/mp4;codecs=avc1
abp
46
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
linkid.js
www.google-analytics.com/plugins/ua/ 		2 KB
722 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:11:38 GMT
content-encoding
br
x-content-type-options
nosniff
age
1981
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
697
x-xss-protection
0
last-modified
Wed, 14 Jun 2023 09:18:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Tue, 20 Jun 2023 20:11:38 GMT
recommendations
a869.mercurynews.com/rest/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a869.mercurynews.com/rest/recommendations?storeId=0595003b-1825-43bc-89bd-9877ca21042f&profileId=e9ed386f-ceb6-490e-9c28-0fae1ca9a01c&frequencyCap=8&itemId=9968021&request=%5B%7B%22id%22%3A1561661563872%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A39.792Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22SAME_CATEGORY%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%2C%7B%22value%22%3A3%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661593537%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A39.792Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22LOOK_ALIKE%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A2%7D%2C%7B%22id%22%3A1561661645802%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A39.793Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22COLLABORATIVE_FILTERING%22%2C%22rampUp%22%3A%22INSTANT%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A1561661684113%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A39.793Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_CTR%22%7D%2C%7B%22value%22%3A7%2C%22algorithm%22%3A%22RECENCY%22%7D%5D%2C%22count%22%3A3%7D%2C%7B%22id%22%3A%22default%22%2C%22filters%22%3A%5B%22VIEWED%22%2C%22publicationDate%3E%3D2023-06-18T19%3A44%3A39.793Z%22%2C%22hasproperty%3Alede%22%2C%22!category%3A%5C%22sponsored%20content%5C%22%22%5D%2C%22boosts%22%3A%5B%7B%22value%22%3A10%2C%22algorithm%22%3A%22RECENT_VIEW%22%7D%5D%2C%22count%22%3Anull%7D%5D&&callback=bc_json212
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-64.jfk50.r.cloudfront.net
Software
- /
Resource Hash
d58ae6ea609795c67de7eea969149b529d8480befb7bd53b7ad20755ec3b4ff1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
via
1.1 6e202b767e6bdee837ba15ada7e3120e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies
master-only
x-amz-cf-pop
JFK50-P5
x-cache
Miss from cloudfront
p3p
policyref="", CP="DSP"
content-length
4488
x-xss-protection
1; mode=block
pragma
no-cache
server
-
content-type
text/javascript;charset=utf-8
cache-control
no-cache, no-store, no-transform, must-revalidate, private
x-robots-tag
noindex, nofollow
x-amz-cf-id
J8kgX_ALrWM6Qnv4YHX-UqOSDdri69o2MFbyaxMwRTUi0LLrv6k8og==
expires
Thu, 01 Jan 1970 00:00:00 GMT
integrator.js
adservice.google.com/adsid/ 		107 B
456 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		94 KB
18 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2291221096554844&correlator=1313686141484864&eid=31075065%2C31075399%2C31075487&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1%2Cinterstitial%2Ctop_leaderboard%2Coutstream_video%2Ccube1_rrail_atf&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4%2C%2F0%2F1%2F2%2F3%2F5%2C%2F0%2F1%2F2%2F3%2F6%2C%2F0%2F1%2F2%2F3%2F7%2C%2F0%2F1%2F2%2F3%2F8&prev_iu_szs=300x50%7C320x50%2C1x1%2C728x90%7C970x90%7C970x250%2C480x360%2C300x250%7C300x600%7C300x1050%7C160x600&ifi=1&adks=1140109686%2C3360478133%2C142133714%2C824671996%2C2052175676&didk=1622125026~356144529~303353385~359666826~302492128&sfv=1-0-40&prev_scp=pos%3DSponsorship_1%7Cpos%3Dinterstitial%7Cpos%3Dtop_leaderboard%7Cpos%3DOutstream_Video%7Cpos%3DCube1_RRail_ATF&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D236787765623%26rurl%3D%26articleid%3D9968021&sc=1&cookie_enabled=1&abxe=1&dt=1687290279885&lmt=1687290279&dlt=1687290276662&idt=1385&adxs=1144%2C160%2C436%2C397%2C1138&adys=79%2C242%2C368%2C2605%2C874&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C0&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&msz=300x0%7C1x0%7C728x0%7C711x0%7C300x0&fws=4%2C4%2C4%2C4%2C4&ohw=501%2C1%2C1280%2C711%2C304&ga_vid=461448689.1687290279&ga_sid=1687290280&ga_hid=1059800600&ga_fc=true&a3p=EhkKCnVpZGFwaS5jb20Y7OHZ0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjg6dnSjTFIAFICCGoSGQoKcHViY2lkLm9yZxje5dnSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y7OHZ0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js?cb=31075399
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
733f34aa5ebc6413c906b024e22edde614d3d471d47a5c93e6ccc283bcba43cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:40 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
18140
x-xss-protection
0
google-lineitem-id
-1,-2,-1,-2,6159522902
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-1,-2,-1,-2,138413520352
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 38BB 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Wed, 19 Jun 2024 19:44:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ecm3
s.amazon-adsystem.com/ Frame 73C7
Redirect Chain
  • https://cs.media.net/cksync?cs=31&type=tam&redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dmedia.net%26id%3D%3Cvsid%3E&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302918801455535000V10
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302918801455535000V10
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
PHQBB0AV21293RSAVJP6
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location
https://s.amazon-adsystem.com/ecm3?ex=media.net&id=3302918801455535000V10
Content-Type
text/html
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
154
x-mnet-hl2
E
Expires
Tue, 20 Jun 2023 19:44:40 GMT
ecm3
s.amazon-adsystem.com/ Frame 73C7
Redirect Chain
  • https://s.ad.smaato.net/c/?adExInit=aps&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsmaato.com%26id%3D%24UID
  • https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=4bdf9286
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=4bdf9286
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
9K0RBNN8328YC7K6DM9T
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 c4460641b6e6b194f0c11732a1b10d1c.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
EWR53-P1
x-cache
FunctionGeneratedResponse from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://s.amazon-adsystem.com/ecm3?ex=smaato.com&id=4bdf9286
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
AbSNeIQooJw760M2uI65xY2yLawIEvn-KSjLZAnYst6XamO0PY8YdA==
syncframe
gum.criteo.com/ Frame 96AA 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
server
Kestrel
server-processing-duration-in-ticks
797277
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11039244145/?random=1687290279007&cv=11&fst=1687290279007&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=124969367.1687290278&uamb=0&uaw=0&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3d7eab053e530796daa6d43d9d197863a516407ac80a18acafd39242cca53d2a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1469
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/11039244145/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/11039244145/?random=1687290278191&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1871015678&rmt_tld=0&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/11039244145/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/11039244145/?random=1687290278191&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1871015678&rmt_tld=1&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
geo.privacymanager.io/ 		30 B
608 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://geo.privacymanager.io/
Requested by
Host: launchpad.privacymanager.io
URL: https://launchpad.privacymanager.io/1/launchpad.bundle.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-61.ewr53.r.cloudfront.net
Software
/
Resource Hash
70fd869f92915eb3c9f85d2d2b5a473ba45239ae463b35267642335337c46f06

Request headers

Accept
application/json
Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 08:46:27 GMT
via
1.1 50f5f6b4e0025748bb74dce1db44c750.cloudfront.net (CloudFront), 1.1 79455aeea26d3c071fd96c3c1432669a.cloudfront.net (CloudFront)
x-amz-cf-pop
IAD89-C1, EWR53-P1
age
39493
x-amzn-requestid
dd44a638-d8a8-484c-abc5-1c3c4352137c
x-amzn-trace-id
Root=1-64916763-3fa25a584427deb858fb8853;Sampled=0;lineage=06620786:0
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type
application/json
access-control-allow-origin
*
x-cache
Hit from cloudfront
x-amz-apigw-id
Gz0XiGa7joEF2eQ=
content-length
30
x-amz-cf-id
S5kCmDhuwQ0MaaWSFfBJRxKDAzZz7f1mt2ufvg3ItDYd6CCfIGJgig==
access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
/
geo.privacymanager.io/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://geo.privacymanager.io/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-61.ewr53.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token
access-control-allow-methods
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin
*
content-length
0
content-type
application/json
date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 fb7a91e6436d6c6ab7f46f75c256840c.cloudfront.net (CloudFront), 1.1 79455aeea26d3c071fd96c3c1432669a.cloudfront.net (CloudFront)
x-amz-apigw-id
G1UyWHxtjoEF8tA=
x-amz-cf-id
rGzGYCpHapzq4KmFD40vkJ1CxlPp6xfIHMjbwYjGc8SGgKK4VYEhaA==
x-amz-cf-pop
JFK51-C1 EWR53-P1
x-amzn-requestid
846e7c90-a8b0-4c26-9d81-b57eb9ae24e3
x-cache
Miss from cloudfront
sync-container.js
b-code.liadm.com/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://b-code.liadm.com/sync-container.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:23cb:7c00:8:8845:1500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 06 Jun 2023 11:53:52 GMT
x-amz-version-id
WIo1DFPCLgnYZuB8yv1dFIDWe1bYBj2G
content-encoding
gzip
last-modified
Tue, 10 May 2022 11:48:07 GMT
server
AmazonS3
via
1.1 043cf9310ff19c0e58a0b6e76877f570.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P1
etag
W/"ae5e94de938b0387eda6df8f20da811a"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=2592000
age
1237848
x-amz-cf-id
8X63ldP4EABqPYBre1TxDCt_H2tzt6PG8HrkikScn5LXPZ252oIc9g==
gtm.js
www.googletagmanager.com/ 		225 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NFD2QGD&l=MG2DL
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
3f4a597222ffe64626a8a60480c9e7369729e446ae5b129795f1922ceb458eda
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:40 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
72872
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:44:40 GMT
amzns2s
rtb.gumgum.com/usync/ Frame 38A9 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.213.218.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-218-94.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b8af4f553fff4eaf46702024235228e57a20b045ca2ea9426b4df14aa682a863

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html;charset=UTF-8
date
Tue, 20 Jun 2023 19:44:40 GMT
etag
W/"05197b13a88e3dc464b4cb5066a814add"
server
nginx
timing-allow-origin
*
usermatch
ssum-sec.casalemedia.com/ Frame 184D
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatch?s=192259&cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0
  • https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
5b781290317bb5a4471047e20b01508bcc414303e5123391bfee2b5c58ee0703

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
1667
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
0
Keep-Alive
timeout=1, max=499
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache

Redirect headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
0
Keep-Alive
timeout=1, max=500
Location
/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
ecm3
s.amazon-adsystem.com/ Frame F52A
Redirect Chain
  • https://ssbsync-us.smartadserver.com/api/sync?callerId=2&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4777538607685951564&gdpr=0&gdpr_consent=
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4777538607685951564&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
0MDBMC75WJ4K9XQWXXPR

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:39 GMT
location
https://s.amazon-adsystem.com/ecm3?ex=smart.com&id=4777538607685951564&gdpr=0&gdpr_consent=
ecm3
s.amazon-adsystem.com/ Frame 6CAC
Redirect Chain
  • https://amazon-tam-match.dotomi.com/match/bounce/current?networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&gdpr=0
  • https://amazon-tam-match.dotomi.com/match/bounce/current?DotomiTest=5048ab6c3736145f&is_secure=true&networkId=31082&version=1&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dcnv.com%26id%3D&...
  • https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAMwa38I1MJkQNkX-yEAAAAAAA&expiration=1687376680&is_secure=true&gdpr=0
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAMwa38I1MJkQNkX-yEAAAAAAA&expiration=1687376680&is_secure=true&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
0Z35GC4RXBABZ0FJ5HQT

Redirect headers

cache-control
no-cache, private, max-age=0, no-store
content-length
0
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
0
location
https://s.amazon-adsystem.com/ecm3?ex=cnv.com&id=AAAMwa38I1MJkQNkX-yEAAAAAAA&expiration=1687376680&is_secure=true&gdpr=0
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
pragma
no-cache
server
nginx
/
match.sharethrough.com/jwumXNuB/v1/ Frame 7FDE 		427 B
939 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.215.8.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-215-8-84.compute-1.amazonaws.com
Software
/
Resource Hash
0a579a5090af8bde46a635d027562e51f8b6efea345ce2655549b13bcc7b008b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-length
427
date
Tue, 20 Jun 2023 19:44:40 GMT
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 738D 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165961
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Thu, 22 Jun 2023 17:50:41 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
userx.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/userx.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ef13b0253a986d36b9de961b9d657b6735fc409299b451d1e9a1454f66ce2fec

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
yQwZyXEurRH1ow5V_7vo0gyZObwynie6
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:40 GMT
x-amz-request-id
3ZG5WV90GBNJ8J6X
age
33622
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
5397
x-amz-id-2
thmnhzLkUogLSdHuUYOzPDvbs+jeo8Sb3ZVYXOYPLNQH+klPA3aPTclOIh+AVsU4Xq/6t3CW7Ms=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:24:18 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.331939,VS0,VE0
etag
"b7cdca876844e9766f1112d8bd36fb5d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
57
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
20614
feed-card-placeholder.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/feed-card-placeholder.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
24999918b7aa7fd5adeca29162085186c3e7cdee5914709c9a927b46b48f05b9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
oTtQuzux.d8yESyUrbo6rF4NhK8d4BsH
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:40 GMT
x-amz-request-id
6FY0XPPCYNMW0Y4H
age
33649
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1262
x-amz-id-2
FSp6kQSw4Jlxoay6c/S87AScTkrlKEkitg/IAWXC/8gtXUeCMtjOFbGiK69zVN1e4TZzL02t2hA=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:23:52 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.331963,VS0,VE0
etag
"b47e6d8318effa2404d0ccb9a7394d61"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
30
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
43173
article-detection.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/article-detection.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
31c86114d8c9683bade57e627634f040284e99a601deb292b961108e5d831415

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
4H3kMWXEvjq2NgzTAQGAVlKPfHF0V_uV
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:40 GMT
x-amz-request-id
DA5VRVW3KJBWBEKQ
age
33661
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1235
x-amz-id-2
IKqEiJ/YCl6zPyY75Oves1yUfyvS73PlTztlin0EHM+Yd9CVZqlXsTnLg+TfDhkthl5Pd1+XKm4=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:23:40 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.338820,VS0,VE0
etag
"1f20295bd8365ddf48f735c926ff0cc2"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
36
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
60315
distance-from-article.20230620-6-RELEASE.es6.js
cdn.taboola.com/libtrc/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/distance-from-article.20230620-6-RELEASE.es6.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
136a576886a9ae3b5d55278a3e69a1fcc0a2189dfbf77ec41787742f260e5526

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
tiKXD9R.iV6EIW70tY.NUChNLGxA7YrV
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:40 GMT
x-amz-request-id
KWZN76QKBRF85VSN
age
33654
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
1134
x-amz-id-2
sy3oqpQqFY+GGz8bBPSkYe3u8cUU1Dp1qCFDLkqy5aUNGQc1ZCPvcLQqpqdubqhqa1agVQ2AjI8=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 20 Jun 2023 10:23:47 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290280.340077,VS0,VE0
etag
"fbfd48aada1c3f9df380e1a033c23ef4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
33
access-control-allow-origin
*
cache-control
private,max-age=2629743
accept-ranges
bytes
x-cache-hits
60331
tamptsync
sync-amz.ads.yieldmo.com/ Frame 98CC 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.203.194.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-203-194-180.compute-1.amazonaws.com
Software
/
Resource Hash
65885ed15d66ec94c80565a604d399137b7554aef11c66a7e44ed3aa97ba111c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-headers
Cache-Control, Pragma, *
access-control-allow-methods
POST, GET, OPTIONS
access-control-allow-origin
*
content-encoding
gzip
content-type
text/html;charset=utf-8
date
Tue, 20 Jun 2023 19:44:40 GMT
pragma
no-cache
vary
accept-encoding
usync.html
eus.rubiconproject.com/ Frame 957C 		281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:40 GMT
ETag
"40010-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding
visitormatch
bh.contextweb.com/ Frame 12F7
Redirect Chain
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint
  • https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
828 B
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
0f1fa96d6743abf4c7cd9df01295b33848f716814f1bc3af015180018ac4ba36
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control
private, max-age=0, no-cache, no-store
content-language
en-CA
content-length
828
content-type
text/html;charset=iso-8859-1
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server
Jetty(10.0.14)
strict-transport-security
max-age=15768000

Redirect headers

accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
cache-control
private, max-age=0, no-cache, no-store
content-language
en-CA
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
location
/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
server
Jetty(10.0.14)
strict-transport-security
max-age=15768000
dinitsync
crb.kargo.com/api/v1/ Frame 1CEB 		0
435 B 		Document
General
Check archive.org
Download Go to
Full URL
https://crb.kargo.com/api/v1/dinitsync?partners=A9
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.206.150.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-206-150-230.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache, no-store, must-revalidate, private, max-age=0
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
Thu, 01 Jan 1970 00:00:00 UTC
Pragma
no-cache
Vary
Origin
X-Accel-Expires
0
ecm3
s.amazon-adsystem.com/ Frame 7CC9
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid=%24UID&ex=appnexus.com&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?id=3321274862842215126&ex=appnexus.com&gdpr=0
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?id=3321274862842215126&ex=appnexus.com&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
1HFWNZ7XYJ850RFE8DVN

Redirect headers

AN-X-Request-Uuid
f05d507b-5414-4bea-8019-56ff8e32f627
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=utf-8
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Location
https://s.amazon-adsystem.com/ecm3?id=3321274862842215126&ex=appnexus.com&gdpr=0
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
amazon
ce.lijit.com/beacon/ Frame 331E
Redirect Chain
  • https://ap.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0
  • https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
8352e1640a8e3207cb4f047a7a196b83b84a60010e0331ea8669c18840b2f9c4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Encoding
gzip
Content-Length
499
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
Vary
Accept-Encoding, User-Agent
X-Sovrn-Pod
ad_ap3ewr1

Redirect headers

Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
Fri, 20 Mar 2009 00:00:00 GMT
Location
https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
P3P
CP="CUR ADM OUR NOR STA NID"
Pragma
no-cache
X-Sovrn-Pod
ad_ap3ewr1
sync-iframe
cs-server-s2s.yellowblue.io/ Frame FED4 		2 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f4ffaab5463be46cf07cbf3c41f176b6460d69227ff571112bee8b2860a5728d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
access-control-allow-origin
cs-server-s2s.yellowblue.io
content-type
text/html
date
Tue, 20 Jun 2023 19:44:40 GMT
server
istio-envoy
x-envoy-upstream-service-time
5
ecm3
s.amazon-adsystem.com/ Frame 8FA6
Redirect Chain
  • https://eb2.3lift.com/getuid?redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID&gdpr=0
  • https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3D3lift.com%26id%3D%24UID
  • https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4361119996463975483505
43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4361119996463975483505
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
REAXASGHRSDAZD8MR842

Redirect headers

cache-control
no-cache, no-store, must-revalidate
content-length
0
date
Tue, 20 Jun 2023 19:44:40 GMT
location
https://s.amazon-adsystem.com/ecm3?ex=3lift.com&id=4361119996463975483505
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
baker
sli.mercurynews.com/ 		19 B
368 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sli.mercurynews.com/baker?dtstmp=1687290280495
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.58.157.143 Piscataway, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-58-157-143.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Tue, 20 Jun 2023 19:44:40 GMT
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
19
Content-Type
image/gif
moatcontent.js
z.moatads.com/nativonielsen548znrb18/ 		167 KB
55 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/nativonielsen548znrb18/moatcontent.js?moatClientLevel1=8448
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.54.69.151 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-69-151.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
4217045a8d701cac3b4a766a11076e7cc5342087464a8a6e3cc7e4f9feec09a3

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

unused62
8096267
date
Tue, 20 Jun 2023 19:44:40 GMT
content-encoding
gzip
last-modified
Mon, 24 Aug 2020 17:04:05 GMT
server
AmazonS3
x-amz-request-id
82F91A5245B4499C
etag
"774acff2cee5852cdfc3fd8471cb2667"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=54815
accept-ranges
bytes
content-length
55696
x-amz-id-2
HxMX4YuovAQtPtmyLOMRI+UKS+eXimafQxyTKx6QVTsrLXpgKIsdNaO+akPBc5GSeAZ3/sC+L9U=
trk.gif
jadserve.postrelease.com/ 		43 B
623 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_at=394&ntv_usid=8685663&ntv_pl=1028524
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.210.36.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-210-36-192.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/ 		43 B
623 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=150520d1-dc2c-47ed-b1b3-0b750e47680a&ntv_fl=DOoEcgB0BB04DrHgiFrFsFF-lFdjD84Is_FOo9090IVUxII_D3Cj6ACXU9GQTCOJT9DRoCK65iH-PjvK-3eajYCBa0NoJhl4eOb6y2IwdvaTrWOCNcvyKHDWfEKdbzi9d5gPxEZIwmvTJlgzdkm5xiek1U1b5Sv8l3y5c1h3zbHbyMOWGJZHxVgNYtTxD__gzkAPq3dpbHOz93vq8k2J33RWUJKD9h4aznDLYDupWxg7x7AotQiHCjMN3BT8G55-kv1qF5XGCt2AQy3UPJ7iWzAHY8DfIh59U4weINeia3iJmgrsOLovktfFpEhxrdvS-5NbGEj5ZAzUZy6b66TPDJJ6Xy-jNV0aYw712nJrP2Bu4taJ4HyS43XLuevPhIYcmHyNNLBh0oc09mbPrI3SCOKSqNjIavu67w6qjIuAU9hfFg8LES3Bj7PZX0DBRYkW&ntv_ht=pwGSZAA&ntv_at=303,302&ntv_a=AAAAAAAAAAjRcRA&ord=1687290280509&ntv_it
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.210.36.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-210-36-192.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/ 		43 B
623 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=2ec0dd3d-bb4b-4d8a-9cf7-c755c41d140a&ntv_fl=w17_ozdxaJTnNoCtXGccc1C64zbwUBVS35TS0mkW_DnCA5mrN-dSNKXELM6tlYqT5AAy10HQFRSm9vS7H-gJ4TAZMRcp8wzPvhnSqzGrSiiTLRfnjVvewDL1z9BpTNze1NZpsmMd8YthxTPQ6yhiNKLm0Xt0NAdybreTO-Lac7pr9hjnyV2Wu1xs_K5EomwOA9Z3Y5DbgBVSOvuNSh-Tm6LA8kLvGTLvL_aSSS6-XEwRUnk2Dc12Wq-Ihrh_V42IISh81padc9LaN37jr80ApI95v7bF8ASIKlUuCHkJ9Wbnmwprm0EY9l8I-XLdryPi_PuL3WAbh0NGP5DsnjmScCY4GiLt4_df-U2d5-gaIErnsC3hmWwUvFJg6dQqacTBglt6GB5HofJzRHtJpRROjOcTtdKy7cXWG-qifTjDxnZE7eo_j_yUE8wEiDEm4tk3&ntv_ht=pwGSZAA&ntv_at=303&ntv_a=AAAAAAAAAArLEPA&ord=1687290280513&ntv_it
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.210.36.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-210-36-192.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/ 		43 B
623 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=2ec0dd3d-bb4b-4d8a-9cf7-c755c41d140a&ntv_fl=w17_ozdxaJTnNoCtXGccc1C64zbwUBVS35TS0mkW_DnCA5mrN-dSNKXELM6tlYqT5AAy10HQFRSm9vS7H-gJ4TAZMRcp8wzPvhnSqzGrSiiTLRfnjVvewDL1z9BpTNze1NZpsmMd8YthxTPQ6yhiNKLm0Xt0NAdybreTO-Lac7pr9hjnyV2Wu1xs_K5EomwOA9Z3Y5DbgBVSOvuNSh-Tm6LA8kLvGTLvL_aSSS6-XEwRUnk2Dc12Wq-Ihrh_V42IISh81padc9LaN37jr80ApI95v7bF8ASIKlUuCHkJ9Wbnmwprm0EY9l8I-XLdryPi_PuL3WAbh0NGP5DsnjmScCY4GiLt4_df-U2d5-gaIErnsC3hmWwUvFJg6dQqacTBglt6GB5HofJzRHtJpRROjOcTtdKy7cXWG-qifTjDxnZE7eo_j_yUE8wEiDEm4tk3&ntv_ht=pwGSZAA&ntv_at=323&ntv_a=AAAAAAAAAArLEPA&ntv_jtr=5&ntv_it
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.210.36.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-210-36-192.compute-1.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
container.html
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 389B 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Wed, 19 Jun 2024 19:44:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4CED 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Wed, 19 Jun 2024 19:44:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
view
securepubads.g.doubleclick.net/pcs/ Frame B7E7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssG21yaiGJ9rDC7j8xIU73p9URQBH7qJZ_GFKwhXYxWZGJvmEBk_WVcziPbHxknM14KogxmgUjepnhOmJ2j19AYoDDJkZ1Ww86lwYU0ktBk0iwgWRgFadxPOS-MkVY0BNaa2ZEzCJxswh-S91ykcjZ_WaDwZPV7rhPOgW0CHw1fQchdVoEVBWMrrzikef3m0qCTHe58tRn6-YqPOQyDEusrXGSYGvM4zNOxbnvHqwcudfHayPr60-JnQ2qzg-oEvYyoYikjD_MhPOZm4Hp7F30gNl9dFeN4zw-JcR4mXJFFA1mVMeAFsdgxdIRXmlmuGbWThP5p5bU4j3SWJ1qEP8-2_BnRvIXuVh6nJQ44DT8OhtEi1cm81XD5YQZYYuox_h7dmMko&sai=AMfl-YT7_JBuL1ZzkjIZDoV-4Bzw1tBoN1QwaUrNHcJeMHjFq4t53vr2s9FvdkzDATNy_ZfpK5VOUBFX3BNV9LrMu2AkND9rVfkbfhWFBuOiuhdjaf7iJg8phz68MezRbw&sig=Cg0ArKJSzDU3haiCnBYCEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:40 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
ttj
secure.adnxs.com/ Frame B7E7 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/ttj?id=28334192
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.89 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
1036836d0835d46da4393dde5d84afeb6769620c68a604faa945e78820bc922f
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:40 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
aa8b17ba-4d8a-43c0-97a2-bbf9b11a6c5f
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame B7E7 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:40 GMT
moatad.js
js.moatads.com/bangdfp107159576598/ Frame B7E7 		0
423 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.moatads.com/bangdfp107159576598/moatad.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.117.182.40 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-117-182-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:40 GMT
Last-Modified
Mon, 14 May 2018 18:19:42 GMT
Server
AmazonS3
x-amz-request-id
BF9VKXDRXKSC3CC5
ETag
"d41d8cd98f00b204e9800998ecf8427e"
Content-Type
application/x-javascript
Cache-Control
max-age=55140
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
0
x-amz-id-2
LqFinxwfRWFSbQXncbvBWr06qUomXyc3AvdsG58ouH1cl93qvPKMNoZFrx99iQdpcsrejYSQRU4=
pixel
protected-by.clarium.io/ Frame B7E7 		68 B
244 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzMxMTE3MjA4NDM6MzAweDI1MA==&v=5&s=v31h3d5cunc&id=eyJkZnAiOnsiYWQiOjUyMzM1MDI2MzYsImMiOjEzODQxMzUyMDM1MiwibCI6NjE1OTUyMjkwMiwibyI6MzExMTcyMDg0MywiQSI6Ii84MDEzL21lcmN1cnluZXdzLmNvbS90aGluZ3MtdG8tZG8vZW50ZXJ0YWlubWVudC9jdWJlMV9ycmFpbF9hdGYiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTYtZ3B0In19&cb=2221276&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6TXhNVEUzTWpBNE5ETTZNekF3ZURJMU1BPT0iLCJ3ZCI6eyJvIjozMTExNzIwODQzLCJ3IjoiMzAwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.107.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-107-2.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/png
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
cache-control
no-store, no-cache, must-revalidate, max-age=0
server
nginx/1.18.0 (Ubuntu)
expires
Sat, 26 Jul 1997 05:00:00 GMT
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
  • https://usersync.gumgum.com/usersync?b=apn&i=3321274862842215126
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=apn&i=3321274862842215126
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Date
Tue, 20 Jun 2023 19:44:40 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
0b6a9611-a152-4fe8-bf45-7d8b2953023c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://usersync.gumgum.com/usersync?b=apn&i=3321274862842215126
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&gdpr=0&gdpr_consent=&us_privacy=
  • https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&gdpr=0&gdpr_consent=&us_privacy=
  • https://beacon.lynx.cognitivlabs.com/bidSwitch.gif?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://x.bidswitch.net/sync?dsp_id=425&user_group=1&expires=365&user_id=cde16cd9-d9ed-4cdd-9d7f-cd6930766499&ssp=gumgum2&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://usersync.gumgum.com/usersync?b=bsw&i=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=&us_privacy=
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=bsw&i=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=&us_privacy=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Location
//usersync.gumgum.com/usersync?b=bsw&i=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=&us_privacy=
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=sta&i=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=sta&i=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Location
https://usersync.gumgum.com/usersync?b=sta&i=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187
Date
Tue, 20 Jun 2023 19:44:40 GMT
Connection
keep-alive
Content-Length
128
Content-Type
text/html; charset=utf-8
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://b1sync.zemanta.com/usersync/gumgum/?puid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&gdpr=0&gdpr_consent=&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
  • https://stags.bluekai.com/site/23178?id=oRzH9Zt83axgglTEQFsr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT232SPJEDSWTUHAZWC6DHM5WFIRKRIZZXE
  • https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=oRzH9Zt83axgglTEQFsr
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=oRzH9Zt83axgglTEQFsr
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Content-Type
text/html; charset=utf-8
Location
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=oRzH9Zt83axgglTEQFsr
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
103
Expires
Thu, 01 Dec 1994 16:00:00 GMT
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
  • https://usersync.gumgum.com/usersync?b=pln&i=37Wunos71Ooo&ev=1&pid=558355
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=pln&i=37Wunos71Ooo&ev=1&pid=558355
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
location
https://usersync.gumgum.com/usersync?b=pln&i=37Wunos71Ooo&ev=1&pid=558355
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
usermatchredir
ssum-sec.casalemedia.com/ Frame 38A9
Redirect Chain
  • https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
  • https://usersync.gumgum.com/usersync?b=obn&i=ENC%28s6yE2BucfO1q6O5cGt5K4cTe7u41Sh94D-uVc8gCn8EN9Pp9URU7hcInpJLkxXge%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
  • https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&obuid=ENC(s6yE2BucfO1q6O5cGt5K4cTe7u41Sh94D-uVc8gCn8EN9Pp9URU7hcInpJLkxXge...
  • https://sync.outbrain.com/syncPlatform?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0
  • https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3Ds6yE2BucfO1q6O5cGt5K4cTe7u41Sh94D-uVc8gCn8EN...
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3Ds6yE2BucfO1q6O5cGt5K4cTe7u41Sh94D-uVc8gCn8EN9Pp9URU7hcInpJLkxXge%26gdpr%3D0%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%0A%26initiator%3Dplatform
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

Location
https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3Ds6yE2BucfO1q6O5cGt5K4cTe7u41Sh94D-uVc8gCn8EN9Pp9URU7hcInpJLkxXge%26gdpr%3D0%26gdpr_consent%3D%24CONSNT_STRING%26us_privacy%3D%24CCPA%0A%26initiator%3Dplatform
Date
Tue, 20 Jun 2023 19:44:42 GMT
X-TraceId
c101684a8651365062760deaeddde5ac
Content-Length
0
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
  • https://usersync.gumgum.com/usersync?b=opx&i=d339c87a-f163-4196-980f-0839cae2f497
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=opx&i=d339c87a-f163-4196-980f-0839cae2f497
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:40 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://usersync.gumgum.com/usersync?b=opx&i=d339c87a-f163-4196-980f-0839cae2f497
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=oth&i=y-Xsg5mxlE2pe96.x9qyFU02OVX2aZ_4PIR_Sm~A
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=oth&i=y-Xsg5mxlE2pe96.x9qyFU02OVX2aZ_4PIR_Sm~A
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:40 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://usersync.gumgum.com/usersync?b=oth&i=y-Xsg5mxlE2pe96.x9qyFU02OVX2aZ_4PIR_Sm~A
content-length
0
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync...
  • https://usersync.gumgum.com/usersync?b=vnt&i=dc345a35-a603-4ec3-b75a-7bd7631cedf4
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=vnt&i=dc345a35-a603-4ec3-b75a-7bd7631cedf4
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Location
https://usersync.gumgum.com/usersync?b=vnt&i=dc345a35-a603-4ec3-b75a-7bd7631cedf4
Date
Tue, 20 Jun 2023 19:44:40 GMT
Connection
keep-alive
X-CI-RTID
617567e7-daaf-4318-9127-0d302843362e
Content-Length
108
Content-Type
text/html; charset=utf-8
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
  • https://usersync.gumgum.com/usersync?b=snc&i=16F85AA78ED646369CC5112051089037
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=snc&i=16F85AA78ED646369CC5112051089037
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 varnish
server
nginx
age
0
access-control-allow-methods
POST,GET,HEAD,OPTIONS
x-varnish
818316092
location
https://usersync.gumgum.com/usersync?b=snc&i=16F85AA78ED646369CC5112051089037
access-control-allow-origin
https://rtb.gumgum.com/
access-control-allow-credentials
true
content-length
0
142
match.deepintent.com/usersync/ Frame 38A9 		0
222 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
g.deepintent.com
Software
a /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:44:40 GMT
server
a
content-length
0
p3p
policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
  • https://usersync.gumgum.com/usersync?b=idi&i=92e9d51d-f58b-4a55-97b2-6ee67deb9268
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=idi&i=92e9d51d-f58b-4a55-97b2-6ee67deb9268
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

location
https://usersync.gumgum.com/usersync?b=idi&i=92e9d51d-f58b-4a55-97b2-6ee67deb9268
access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:41 GMT
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
usersync
usersync.gumgum.com/ Frame 38A9
Redirect Chain
  • https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=sad&i=4777538607685951564
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=sad&i=4777538607685951564
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

location
https://usersync.gumgum.com/usersync?b=sad&i=4777538607685951564
date
Tue, 20 Jun 2023 19:44:40 GMT
content-length
0
ecm3
s.amazon-adsystem.com/ Frame 38A9 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=gg.com&id=u_505daddb-b9f3-4eff-a7a6-25c842c0512d
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://rtb.gumgum.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
JVV6GNJEE38H8VF630E5
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
c55320f9-851b-4eae-a242-46d7297c1104
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/c55320f9-851b-4eae-a242-46d7297c1104
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
usermatchredir
ssum-sec.casalemedia.com/ Frame 184D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZJIBqD7bZiR98t4YH35qSwAADZ0AAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEGNTMINOlncDrepDG2fIvx0&google_cver=1
43 B
766 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEGNTMINOlncDrepDG2fIvx0&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=498
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEGNTMINOlncDrepDG2fIvx0&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
364
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 184D
Redirect Chain
  • https://match.adsrvr.org/track/cmf/casale
  • https://match.adsrvr.org/track/cmb/casale?
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=db51a350-c421-4780-94b8-db6155d007ec&expiration=1689882280&gdpr=0&gdpr_consent=
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=db51a350-c421-4780-94b8-db6155d007ec&expiration=1689882280&gdpr=0&gdpr_consent=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=497
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=db51a350-c421-4780-94b8-db6155d007ec&expiration=1689882280&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
dcm
s.amazon-adsystem.com/ Frame 184D 		43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZJIBqD7bZiR98t4YH35qSwAADZ0AAAAB&gpp=&gpp_sid=
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
WY6F71PFVCX625SB65VX
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
crum
dsum-sec.casalemedia.com/ Frame 184D
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZJIBqD7bZiR98t4YH35qSwAA
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHFE4sN5kzw-2axyRnpj3t0&google_cver=1
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHFE4sN5kzw-2axyRnpj3t0&google_cver=1
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=496
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEHFE4sN5kzw-2axyRnpj3t0&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 184D
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=68
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=ruPoSpZIUIJ7GLwbam2kAZU4mbs
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=ruPoSpZIUIJ7GLwbam2kAZU4mbs
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=123&external_user_id=ruPoSpZIUIJ7GLwbam2kAZU4mbs
Date
Tue, 20 Jun 2023 19:44:40 GMT
Connection
keep-alive
Content-Length
122
Content-Type
text/html; charset=utf-8
crum
dsum-sec.casalemedia.com/ Frame 184D
Redirect Chain
  • https://cm.adgrx.com/bridge?AG_PID=casale&AG_SETCOOKIE
  • https://cm.adgrx.com/bridge.gif?AG_PID=casale
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=e5c920de-0fa2-11ee-876c-8dbcb6804b27
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=e5c920de-0fa2-11ee-876c-8dbcb6804b27
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
server
Cowboy
content-type
image/gif
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=41&external_user_id=e5c920de-0fa2-11ee-876c-8dbcb6804b27
access-control-allow-origin
*
p3p
CP="NOI OTC OTP OUR NOR"
cache-control
no-cache, no-store, must-revalidate, proxy-revalidate
x-realserver-nx
lga-delivery-8
content-length
0
expires
Thu, 23 Sep 2004 17:42:04 GMT
crum
dsum-sec.casalemedia.com/ Frame 184D
Redirect Chain
  • https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=8B59A33699C741AFA2C7A091E574C7C9
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=8B59A33699C741AFA2C7A091E574C7C9
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=498
Content-Length
43
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:40 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=8B59A33699C741AFA2C7A091E574C7C9
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Mon, 19 Jun 2023 19:44:40 GMT
tp_out
d.adroll.com/cm/index/ Frame 184D 		42 B
181 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:61c0:2204:b513:b8fc:2d8f:8df9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:40 GMT
cache-control
no-transform,public,max-age=300,s-maxage=900
server
nginx/1.22.1
content-length
42
vary
Cookie
content-type
image/gif
ecm3
s.amazon-adsystem.com/ Frame 184D 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=index.com&id=ZJIBqD7bZiR98t4YH35qSwAADZ0AAAAB
Requested by
Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dindex.com%26id%3D%24UID&gdpr=0&s=192259&C=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum-sec.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
B0YW2AQ1SHQZDSZ2K7ZC
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sid
mug.criteo.com/ Frame 96AA
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertagids&domain=mercurynews.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=JPcN63xja3RPUzI4UW9vbkcydjhzZmpmRWZ1RmxpY1dTK09yMVZiaWNQTzh0dVZVNElZWmJGNFdxWWVSOUg0VEIwQ2FLTXllQUVTWU0vazduM3VRQlN5U0dGMDJnbDdHTW03bFI3Umk3ckNOODJYTlYxczZkd3JpcWtGWk...
431 B
653 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=JPcN63xja3RPUzI4UW9vbkcydjhzZmpmRWZ1RmxpY1dTK09yMVZiaWNQTzh0dVZVNElZWmJGNFdxWWVSOUg0VEIwQ2FLTXllQUVTWU0vazduM3VRQlN5U0dGMDJnbDdHTW03bFI3Umk3ckNOODJYTlYxczZkd3JpcWtGWkYvKzBqdXpIOXVmWmsyeG5xWVZWZGJPRXB5RUVBTU5hcmtRb2ZKWVlPWHc3UFZRVEMvajd3WUNpYWdqa0Vob2lUT1RRNnp0c2QxOExEb1Zoc3VGNk5mcXRXS3BaU25tdENnbEphTlZBMnZQbnhDMFJPeTUwUmJMN2dVZi9NSUp5d0xLeXJabHViSW1CU0RQZDdxZDJDb2E0NW9jdlpQdz09fA&cppv=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
53ec751bb303f77b16e6c949e4e5d3e85664d82205f00981199616f4927bb6e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1401304
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=JPcN63xja3RPUzI4UW9vbkcydjhzZmpmRWZ1RmxpY1dTK09yMVZiaWNQTzh0dVZVNElZWmJGNFdxWWVSOUg0VEIwQ2FLTXllQUVTWU0vazduM3VRQlN5U0dGMDJnbDdHTW03bFI3Umk3ckNOODJYTlYxczZkd3JpcWtGWkYvKzBqdXpIOXVmWmsyeG5xWVZWZGJPRXB5RUVBTU5hcmtRb2ZKWVlPWHc3UFZRVEMvajd3WUNpYWdqa0Vob2lUT1RRNnp0c2QxOExEb1Zoc3VGNk5mcXRXS3BaU25tdENnbEphTlZBMnZQbnhDMFJPeTUwUmJMN2dVZi9NSUp5d0xLeXJabHViSW1CU0RQZDdxZDJDb2E0NW9jdlpQdz09fA&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
487210
content-length
0
expires
0
collect
www.google-analytics.com/j/ 		4 B
24 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=1059800600&t=pageview&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&dr=&dp=%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDACEAjBAAAACgFK~&jid=1411866594&gjid=1068003052&cid=461448689.1687290279&tid=UA-61435456-5&_gid=183842644.1687290279&_r=1&_slc=1&gtm=45He36e0n71TLFP4R&cd2=mercurynews.com&cd3=mercurynews.com&cd4=&cd5=2023-06-20T11%3A12%3A40-07%3A00&cd6=2023-06-20T11%3A12%3A40-07%3A00&cd7=2023-06-20T11%3A52%3A17-07%3A00&cd9=no&cd10=Entertainment&cd11=6.2.2&cd12=&cd13=WP&cd14=Entertainment&cd15=Entertainment&cd16=Things%20To%20Do&cd17=&cd18=&cd19=&cd20=&cd21=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&cd22=meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&cd23=9968021&cd24=article&cd25=BANG&cd26=Martha%20Ross&cd27=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%27%20ex-Spotify%20exec%20tells%20BBC&cd28=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&cd29=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20just%20%E2%80%9812%20hours%20work%2C%27%20ex-Spotify%20exec%20tells%20BBC&cd30=&cd32=p-4ctCQwtnNBNs2&cd33=BayAreaNewsGroup&cd34=true&cd35=&cd36=5021&cd37=801&cd38=Martha%20Ross&cd42=Not%20Set&cd49=false&cd50=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&cd51=&cd54=no_email&cd55=Bay%20Area%20News%20Group&cd61=Not%20Set&cd62=free&cd63=Not%20Set&cd64=Entertainment%2CThings%20To%20Do&cd65=The%20Mercury%20News&cd53=461448689.1687290279&z=602320893
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/collect
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 7FDE 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=sharethrough.com&id=45bb695b-34f1-45bc-b104-fd1bfa86c044
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
K9TQXCJ7NP55X10JME31
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
v1
match.sharethrough.com/sync/ Frame 7FDE
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=1
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
68 B
606 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
18.215.8.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-215-8-84.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
v1
match.sharethrough.com/sync/ Frame 7FDE
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=2
  • https://ssum.casalemedia.com/usermatchredir?s=186046&cb=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3DGM7HYz3VFjuymbiqnJLyjuPy%26source_user_id%3D__UID__
  • https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=ZJIBqD7bZiR98t4YH35qSwAA%263485
68 B
604 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=ZJIBqD7bZiR98t4YH35qSwAA%263485
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
18.215.8.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-215-8-84.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://match.sharethrough.com/sync/v1?source_id=GM7HYz3VFjuymbiqnJLyjuPy&source_user_id=ZJIBqD7bZiR98t4YH35qSwAA%263485
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
0
Expires
0
v1
match.sharethrough.com/sync/ Frame 7FDE
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=3
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=sharethrough&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
68 B
611 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
18.215.8.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-215-8-84.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://match.sharethrough.com/sync/v1?source_id=5b286190338513af73f09c28&source_user_id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
323
v1
match.sharethrough.com/sync/ Frame 7FDE
Redirect Chain
  • https://match.sharethrough.com/jwumXNuB_CMA/v1/?q=4
  • https://sync.srv.stackadapt.com/sync?nid=15
  • https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187&gdpr=&gdpr_consent=
68 B
608 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187&gdpr=&gdpr_consent=
Requested by
Host: match.sharethrough.com
URL: https://match.sharethrough.com/jwumXNuB/v1/?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dsharethrough.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
18.215.8.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-215-8-84.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://match.sharethrough.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

Location
https://match.sharethrough.com/sync/v1?source_id=f832af09fdaea37e940528ab&source_user_id=0-aee3e84a-9648-5082-7b18-bc1b6a6da401$ip$149.56.153.187&gdpr=&gdpr_consent=
Date
Tue, 20 Jun 2023 19:44:41 GMT
Connection
keep-alive
Content-Length
200
Content-Type
text/html; charset=utf-8
bulk
trc.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
467 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/medianewsgroup-mercurynews/log/3/bulk?tvi2=4948&route=US%3AUS%3AV&lti=deflated&bulkSize=10
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

x-vcl-time-ms
14
date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 varnish
x-fastly-to-nlb-rtt
9797
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
x-service-version
v2
x-served-by
cache-yul12823-YUL
pragma
no-cache
server
nginx
x-timer
S1687290281.760214,VS0,VE14
content-type
image/gif
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
rtset
bh.contextweb.com/bh/ Frame 12F7
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=ODBGRjI3UktjS2ZHNUF5NjJidjFqQQ&gdpr=0&gdpr_consent=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDCqW60D2mGdp7ne38rlgqo&google_cver=1
49 B
813 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDCqW60D2mGdp7ne38rlgqo&google_cver=1
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Protocol
H2
Server
198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://bh.contextweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
content-type
image/gif;charset=iso-8859-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=0&gdpr_consent=&ev=CAESEDCqW60D2mGdp7ne38rlgqo&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
335
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame 12F7
Redirect Chain
  • https://pulsepoint-match.dotomi.com/match/bounce/current?networkId=14200&version=1&nuid=
  • https://pulsepoint-match.dotomi.com/match/bounce/current?DotomiTest=7be1ef66bce234f&is_secure=true&networkId=14200&version=1&nuid=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMwa38I1MJswMnwj_kAAAAAAA&expiration=1687376680&nuid=&is_secure=true
49 B
849 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMwa38I1MJswMnwj_kAAAAAAA&expiration=1687376680&nuid=&is_secure=true
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Protocol
H2
Server
198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://bh.contextweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
content-type
image/gif;charset=iso-8859-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://bh.contextweb.com/bh/rtset?do=add&pid=530912&ev=AAAMwa38I1MJswMnwj_kAAAAAAA&expiration=1687376680&nuid=&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
ecm3
s.amazon-adsystem.com/ Frame 12F7 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=37Wunos71Ooo&ex=Pulsepoint
Requested by
Host: bh.contextweb.com
URL: https://bh.contextweb.com/visitormatch?p=547259,530912,534301,548607,543793,561117&rurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%25%25VGUID%25%25%26ex%3DPulsepoint&reat=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://bh.contextweb.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
RQDF7PJ6K8F8KJASP1QM
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
cs
cs.yellowblue.io/ Frame FED4
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3663&gdpr=0&gdpr_consent=
  • https://cs.yellowblue.io/cs?aid=11601&id=cd6f6ccf771b1516e146ebb42d12c42&gdpr_consent=&gdpr=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11601&id=cd6f6ccf771b1516e146ebb42d12c42&gdpr_consent=&gdpr=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
0
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Server
nginx
Access-Control-Allow-Origin
*
Location
https://cs.yellowblue.io/cs?aid=11601&id=cd6f6ccf771b1516e146ebb42d12c42&gdpr_consent=&gdpr=0
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
x-sticky-vk
1687290280855032-86
cs
cs-server-s2s.yellowblue.io/ Frame FED4
Redirect Chain
  • https://us-u.openx.net/w/1.0/cm?id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D
  • https://us-u.openx.net/w/1.0/cm?cc=1&id=58ceaaf5-c766-4c17-869a-d76e43401714&gdpr=0&gdpr_consent=&r=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11563%26id%3D
  • https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=cc04709c-0e99-4485-b433-4446231b2192
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=cc04709c-0e99-4485-b433-4446231b2192
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:40 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://cs-server-s2s.yellowblue.io/cs?aid=11563&id=cc04709c-0e99-4485-b433-4446231b2192
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
cs
cs-server-s2s.yellowblue.io/ Frame FED4
Redirect Chain
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11603%26gdpr%3D%5BGDPR%5D%26gdpr_consent%3D%5BUSER_CONSENT%5D%26uid%3D$%7BBSW_UUID%7D
  • https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=2491035f-3b91-450a-bf47-d3da43a3fb7b
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Location
https://cs-server-s2s.yellowblue.io/cs?aid=11603&gdpr=[GDPR]&gdpr_consent=[USER_CONSENT]&uid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Date
Tue, 20 Jun 2023 19:44:40 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
cs
cs-server-s2s.yellowblue.io/ Frame FED4
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11596%26id%3D$UID&gdpr=0&gdpr_consent=
  • https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=3321274862842215126&gdpr=0&gdpr_consent=
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=3321274862842215126&gdpr=0&gdpr_consent=
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
9
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Date
Tue, 20 Jun 2023 19:44:40 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
2af45059-baa9-41ad-a448-4488a6921dc0
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://cs-server-s2s.yellowblue.io/cs?aid=11596&id=3321274862842215126&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cksync.php
contextual.media.net/ Frame FED4 		61 B
459 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=25&type=ris&ovsid=%7B%7BAPID%7D%7D&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11585%26id%3D%3Cvsid%3E
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.93 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:41 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
61
x-mnet-hl2
E
expires
Tue, 20 Jun 2023 19:44:41 GMT
cs
cs-server-s2s.yellowblue.io/ Frame FED4
Redirect Chain
  • https://sync.go.sonobi.com/us?gdpr=0&consent_string=&loc=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D115667%26uid%3D%5BUID%5D
  • https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=2c0f44d2-6a66-40d3-a3dc-600d11c96224
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=2c0f44d2-6a66-40d3-a3dc-600d11c96224
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
go-iad-2-5-150
Content-Type
text/plain; charset=utf8
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://cs-server-s2s.yellowblue.io/cs?aid=115667&uid=2c0f44d2-6a66-40d3-a3dc-600d11c96224
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Length
0
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
cs
cs-server-s2s.yellowblue.io/ Frame FED4
Redirect Chain
  • https://csync.loopme.me/?pubid=11362&gdpr=0&gdpr_consent=&redirect=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11571%26id%3D%7Bdevice_id%7D
  • https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr_consent=null&gdpr=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr_consent=null&gdpr=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs-server-s2s.yellowblue.io/cs?aid=11571&id=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr_consent=null&gdpr=0
date
Tue, 20 Jun 2023 19:44:41 GMT
server
_
content-length
0
cs
cs.yellowblue.io/ Frame FED4
Redirect Chain
  • https://ups.analytics.yahoo.com/ups/58760/sync?redir=true&gdpr=0&gdpr_consent=
  • https://cs.yellowblue.io/cs?aid=11591&id=y-RIWzuEFE2uKow5_PIsLk26F1cS2t77MI~A&gdpr_in_effect=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11591&id=y-RIWzuEFE2uKow5_PIsLk26F1cS2t77MI~A&gdpr_in_effect=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs.yellowblue.io/cs?aid=11591&id=y-RIWzuEFE2uKow5_PIsLk26F1cS2t77MI~A&gdpr_in_effect=0
date
Tue, 20 Jun 2023 19:44:41 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
cs
cs.yellowblue.io/ Frame FED4
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=5926d422&gdpr=0&gdpr_consent=
  • https://cs.yellowblue.io/cs?aid=11587&uid=45bb695b-34f1-45bc-b104-fd1bfa86c044&gdpr=0
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11587&uid=45bb695b-34f1-45bc-b104-fd1bfa86c044&gdpr=0
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

location
https://cs.yellowblue.io/cs?aid=11587&uid=45bb695b-34f1-45bc-b104-fd1bfa86c044&gdpr=0
date
Tue, 20 Jun 2023 19:44:40 GMT
content-length
0
Pug
image2.pubmatic.com/AdServer/ Frame FED4
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160295&gdpr=0&gdpr_consent=&pu=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11576%26id%3D%23PMUID&rdf=1
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OUU4QjIxMEItMjlGMC00NzMzLUJERjctMTM0NEQ2OEMzMzc2&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cs
cs-server-s2s.yellowblue.io/ Frame FED4
Redirect Chain
  • https://ssc-cms.33across.com/ps/?ri=0015a00002hdV5tAAE&ru=https%3A%2F%2Fcs-server-s2s.yellowblue.io%2Fcs%3Faid%3D11580%26puid%3D33XUSERID33X
  • https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212190061798909
0
329 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212190061798909
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://cs-server-s2s.yellowblue.io/
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
referrer-policy
unsafe-url
server
33XP004
x-33x-status
100000000008200000C
p3p
CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location
https://cs-server-s2s.yellowblue.io/cs?aid=11580&puid=212190061798909
cache-control
no-store, no-cache, must-revalidate
content-length
0
expires
Thu, 01-Jan-70 00:00:01 GMT
ecm3
s.amazon-adsystem.com/ Frame FED4 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rise.com&id=_NzvLO6tCp_s
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://cs-server-s2s.yellowblue.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
W5PSDTCVM0E2F9JJ3CMY
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 98CC 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=ym.com&id=g64ff5b6b6307102e7fd&gdpr=0
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
WPE1RD3PH676QR2V73VH
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sync
ads.yieldmo.com/ Frame 98CC
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=yieldmo
  • https://ads.yieldmo.com/sync?pn_id=rc&id=LJ4P2F0B-P-LXKJ
43 B
462 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/sync?pn_id=rc&id=LJ4P2F0B-P-LXKJ
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.218.133.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-133-69.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ads.yieldmo.com/sync?pn_id=rc&id=LJ4P2F0B-P-LXKJ
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
ace9692b4e77bdf741ff63add80edaca
Expires
0
sync
ads.yieldmo.com/v000/ Frame 98CC
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&redir%3Dhttps%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3D%5BRX_UUID%5D
  • https://sync.1rx.io/usersync2/rmpssp?sub=yieldmo&zcc=1&cb=1687290281073
  • https://ad.turn.com/r/cs?pid=45&rndcb=2342778772
  • https://sync.1rx.io/usersync/turn/8787793056595731277?dspret=1&gdpr=&gdpr_consent=&us_privacy=
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fads.yieldmo.com%2Fv000%2Fsync%3Fpn_id%3Dunl%26id%3DRX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0...
  • https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
43 B
807 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.218.133.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-133-69.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

Date
Tue, 20 Jun 2023 19:44:42 GMT
Server
Tengine
ETag
RX0582ffcc029a4b6a9d8acee11ea1f0b8005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location
https://ads.yieldmo.com/v000/sync?pn_id=unl&id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Content-Type
text/html
Connection
keep-alive
receive
pixel.tapad.com/idsync/ex/ Frame 98CC
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3107&partner_device_id=g64ff5b6b6307102e7fd
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=6e633baa-8f35-487f-a052-7b9fb224da66%252C%252C&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=db51a350-c421-4780-94b8-db6155d007ec&ttd_puid=6e633baa-8f35-487f-a052-7b9fb224da66%2C%2C
95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=db51a350-c421-4780-94b8-db6155d007ec&ttd_puid=6e633baa-8f35-487f-a052-7b9fb224da66%2C%2C
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H3
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=db51a350-c421-4780-94b8-db6155d007ec&ttd_puid=6e633baa-8f35-487f-a052-7b9fb224da66%2C%2C
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
359
sync
ads.yieldmo.com/v000/ Frame 98CC
Redirect Chain
  • https://ib.adnxs.com/getuid?https://ads.yieldmo.com/v000/sync?userid=$UID&pn_id=an
  • https://ads.yieldmo.com/v000/sync?userid=3321274862842215126&pn_id=an
43 B
566 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?userid=3321274862842215126&pn_id=an
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
3.218.133.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-133-69.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

Date
Tue, 20 Jun 2023 19:44:41 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
0ba7c636-fd3f-4180-840a-3e2d4faa3383
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://ads.yieldmo.com/v000/sync?userid=3321274862842215126&pn_id=an
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 98CC
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
  • https://image8.pubmatic.com/AdServer/ImgSync?p=160648&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D160648%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Fsync-pm.ads.y...
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NDc5Q0M2MjEtQjJFMC00OTBELTg5MTUtNDIwNTVFQkJDMEVC&gdpr=-1&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
42 B
113 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
Requested by
Host: sync-amz.ads.yieldmo.com
URL: https://sync-amz.ads.yieldmo.com/tamptsync?callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dym.com%26id%3D%24UID&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync-amz.ads.yieldmo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:40 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
st
imprnjmp.taboola.com/ Frame D42D 		7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://imprnjmp.taboola.com/st?cijs=convusmp&ttype=0&cisd=convusmp&cipid=66361655&crid=-1&dast=V8IVYCLAYki4IjLRbgOhJIFgVHWizAdSwAAABgYID-AIkZl7uJYTFzi2Y201q08YzcEodltBZ5DIORc-SyOGc2IyAx43I3MSxmbtHMZlqLNp6RW-KwjNYij2Ewco5cFufMZgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxZDD4iChiCv3HiIEZUUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABR20qOKYvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjc_iGm8XC4rKZJs7dxOPxbQa73cQ5GexmnsVse5zBJ5VTLaSk-oQIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYKJic0zM0yGa5VhNluLJhPbWjgZLdzKkWO1nM2GK5dvtRa9PqaLcWLcTWZbJBiwuBfJ0yKdCEeG4WplXI5si93M4XJOlouVceYYuWyj1WRlsU3EEs3JIp3ILvuOzeEbbhYLi8tmmjh3E4_HtxnsdhPnZLCbeRazfWNi88wMk-FaZZjN1qLJxLYWTkYLt3LkWC1ns-HK5VutRa-P6WKcGHeT2b4xG-4my8FkN9w3ZsPdZDmY7Ib7Dp3hu_qcjdLJUuzRqVbLyEtncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&cmcv=&pix=undefined&cb=1687290280813&uv=136905167&tms=1687290280813&abt=lotc_vD!nonrv_vA!t45!testmsn_vB!ufm_vE!ul136905-167_vA&ft=0&su=6&unm=FEED_MANAGER&aure=false&agl=1&cirid=f897b01f-4ff4-4c3d-ba24-dc00d9deb9ff&excid=e22lLINE_ITEM_ID_WILL_BE_HERE_ON_SERVINGc&tst=1&docw=0&cs=true&cias=1
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
058b2f66dcdfde7a5275318c3ba20a88024351adec38c6ab9892d379690b58b4

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-type
text/html;charset=ISO-8859-1
date
Tue, 20 Jun 2023 19:44:40 GMT
server
nginx
vary
Accept-Encoding
via
1.1 varnish
x-cache
MISS
x-cache-hits
0
x-served-by
cache-yul12823-YUL
x-timer
S1687290281.831983,VS0,VE15
sync
us-match.taboola.com/ Frame BD91 		7 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://us-match.taboola.com/sync?dast=V8IVYCLAYki4IjLRbgOhJIFgVHWizAdSwAAABgYID-AIkZl7uJYTFzi2Y201q08YzcEodltBZ5DIORc-SyOGc2IyAx43I3MSxmbtHMZlqLNp6RW-KwjNYij2Ewco5cFufMZgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxZDD4iChiCv3HiIEZUUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABR20qOKYvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjc_iGm8XC4rKZJs7dxOPxbQa73cQ5GexmnsVse5zBJ5VTLaSk-oQIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYKJic0zM0yGa5VhNluLJhPbWjgZLdzKkWO1nM2GK5dvtRa9PqaLcWLcTWZbJBiwuBfJ0yKdCEeG4WplXI5si93M4XJOlouVceYYuWyj1WRlsU3EEs3JIp3ILvuOzeEbbhYLi8tmmjh3E4_HtxnsdhPnZLCbeRazfWNi88wMk-FaZZjN1qLJxLYWTkYLt3LkWC1ns-HK5VutRa-P6WKcGHeT2b4xG-4my8FkN9w3ZsPdZDmY7Ib7Dp3hu_qcjdLJUuzRqVbLyEtncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&excid=22&docw=0&cijs=1&nlb=false
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
53a0ab3378c2f049263ebcc0c75640e510b79c8f7f11ed06a2f0b044e6639c87

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
text/html;charset=ISO-8859-1
date
Tue, 20 Jun 2023 19:44:40 GMT
machineid
3106
server
nginx
st
us-vid-events.taboola.com/ 		0
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-vid-events.taboola.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=66361655&crid=-1&dast=V8IVYCLAYki4IjLRbgOhJIFgVHWizAdSwAAABgYID-AIkZl7uJYTFzi2Y201q08YzcEodltBZ5DIORc-SyOGc2IyAx43I3MSxmbtHMZlqLNp6RW-KwjNYij2Ewco5cFufMZgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxZDD4iChiCv3HiIEZUUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABR20qOKYvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjc_iGm8XC4rKZJs7dxOPxbQa73cQ5GexmnsVse5zBJ5VTLaSk-oQIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYKJic0zM0yGa5VhNluLJhPbWjgZLdzKkWO1nM2GK5dvtRa9PqaLcWLcTWZbJBiwuBfJ0yKdCEeG4WplXI5si93M4XJOlouVceYYuWyj1WRlsU3EEs3JIp3ILvuOzeEbbhYLi8tmmjh3E4_HtxnsdhPnZLCbeRazfWNi88wMk-FaZZjN1qLJxLYWTkYLt3LkWC1ns-HK5VutRa-P6WKcGHeT2b4xG-4my8FkN9w3ZsPdZDmY7Ib7Dp3hu_qcjdLJUuzRqVbLyEtncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&cmcv=&pix=31589837&cb=1687290280813&uv=136905167&tms=1687290280813&abt=lotc_vD!nonrv_vA!t45!testmsn_vB!ufm_vE!ul136905-167_vA&ft=0&su=6&unm=FEED_MANAGER&debug=pn:!sqg:!torgn:1687290276567.6!ts:1687290280813&mntl=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:40 GMT
content-length
0
server
nginx
user-sync
sync.adkernel.com/ Frame 96FA 		22 B
192 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
174.137.133.32 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software
nginx /
Resource Hash
4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Age
0
Cache-Control
no-store
Connection
close
Content-Length
22
Date
Tue, 20 Jun 2023 19:44:40 GMT
Pragma
no-cache
Server
nginx
e9d4ff858b5e32317e843f5ed11b2659.gif
cs.iqzone.com/ Frame 212B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.iqzone.com/e9d4ff858b5e32317e843f5ed11b2659.gif?puid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diqz
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
8.2.111.13 , United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:44 GMT
Server
nginx
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 832D 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165961
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Thu, 22 Jun 2023 17:50:41 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
usersync
usersync.gumgum.com/ Frame 225A
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://usersync.gumgum.com/usersync?b=ttd&i=db51a350-c421-4780-94b8-db6155d007ec
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=ttd&i=db51a350-c421-4780-94b8-db6155d007ec
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
0
Pragma
no-cache

Redirect headers

cache-control
private,no-cache, must-revalidate
content-length
193
content-type
text/html
date
Tue, 20 Jun 2023 19:44:40 GMT
location
https://usersync.gumgum.com/usersync?b=ttd&i=db51a350-c421-4780-94b8-db6155d007ec
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
usersync
usersync.gumgum.com/ Frame 6EA4
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
  • https://usersync.gumgum.com/usersync?b=mmh&i=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=mmh&i=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:41 GMT
Expires
0
Pragma
no-cache

Redirect headers

Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:40 GMT
Expires
Tue, 20 Jun 2023 19:44:39 GMT
Keep-Alive
timeout=360
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
MT3 1031 59fd23a master iad iad-pixel-x30 config_version:"1969"
location
https://usersync.gumgum.com/usersync?b=mmh&i=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
usersync
usersync.gumgum.com/ Frame F30D
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=ZJIBqAABSFKRcAAz
  • https://usersync.gumgum.com/usersync?b=atm&i=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=&_test=ZJIBqAABSFKRcAAz
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=atm&i=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=&_test=ZJIBqAABSFKRcAAz
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:41 GMT
Expires
0
Pragma
no-cache

Redirect headers

accept-ranges
bytes
cache-control
no-cache
content-length
0
date
Tue, 20 Jun 2023 19:44:40 GMT
location
https://usersync.gumgum.com/usersync?b=atm&i=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=&_test=ZJIBqAABSFKRcAAz
pragma
no-cache
retry-after
0
server
Varnish
via
1.1 varnish
x-cache
HIT
x-cache-hits
0
x-served-by
cache-yul12829-YUL
x-timer
S1687290281.941465,VS0,VE0
ecm3
s.amazon-adsystem.com/ Frame 331E 		43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=G2VgbPZHuyVpOjRtQ-i3ojE3&ex=sovrn.com&gdpr=0&gdpr=0&gdpr_consent=
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:40 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
5PKJ6VG6TGABVCJXDSDR
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
merge
ce.lijit.com/ Frame 331E
Redirect Chain
  • https://cms.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=m9yu7p3Z9uqAiafqmt666Z_Zp-2AiaLlmtzxSaVw
43 B
879 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=m9yu7p3Z9uqAiafqmt666Z_Zp-2AiaLlmtzxSaVw
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap3ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:40 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://ce.lijit.com/merge?pid=43&gdpr=0&gdpr_consent=&us_privacy=&3pid=m9yu7p3Z9uqAiafqmt666Z_Zp-2AiaLlmtzxSaVw
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
merge
ce.lijit.com/ Frame 331E
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=87&3pid=45f36b13-857c-4e12-af33-6a514e9bfc45
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=87&3pid=45f36b13-857c-4e12-af33-6a514e9bfc45
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap3ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location
//ce.lijit.com/merge?pid=87&3pid=45f36b13-857c-4e12-af33-6a514e9bfc45
date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
no-cache, no-store, must-revalidate
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
sovrn
tr.blismedia.com/v1/api/sync/ Frame 331E 		0
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.blismedia.com/v1/api/sync/sovrn?gdpr=0&gdpr_consent=
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
8.105.96.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
merge
ce.lijit.com/ Frame 331E
Redirect Chain
  • https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=83&3pid=LJ4P2F0B-P-LXKJ&gdpr=0
43 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=83&3pid=LJ4P2F0B-P-LXKJ&gdpr=0
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap3ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://ce.lijit.com/merge?pid=83&3pid=LJ4P2F0B-P-LXKJ&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
7c5d24517ee193cc868994bc18883d1d
Expires
0
merge
ce.lijit.com/ Frame 331E
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=49&3pid=37Wunos71Ooo&ev=1&pid=558511&gdpr_consent=&gdpr=0
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=49&3pid=37Wunos71Ooo&ev=1&pid=558511&gdpr_consent=&gdpr=0
Requested by
Host: ce.lijit.com
URL: https://ce.lijit.com/beacon/amazon?url=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fid%3D%24UID&ex=sovrn.com&gdpr=0&dnr=1
Protocol
HTTP/1.1
Server
23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ce.lijit.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap3ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
location
https://ce.lijit.com/merge?pid=49&3pid=37Wunos71Ooo&ev=1&pid=558511&gdpr_consent=&gdpr=0
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
usync.js
eus.rubiconproject.com/ Frame 957C 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:40 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Jun 2023 08:41:09 GMT
Server
Apache/2.2.15 (CentOS)
X-Powered-By
PHP/5.3.3
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control
max-age=46565
Connection
keep-alive
Content-Length
10113
Expires
Wed, 21 Jun 2023 08:40:45 GMT
/
onetag-sys.com/usync/ Frame B6C9 		2 KB
815 B 		Document
General
Check archive.org
Download Go to
Full URL
https://onetag-sys.com/usync/?pubId=69f48c2160c8113&gdpr=0&gdpr_consent=
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
51.222.39.187 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ip187.ip-51-222-39.net
Software
/
Resource Hash
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-transform, no-cache
content-encoding
gzip
content-length
731
content-type
text/html
strict-transport-security
max-age=15552000
usync.html
eus.rubiconproject.com/ Frame 3828
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=rise_engage&endpoint=us-east
  • https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
281 B
401 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Requested by
Host: cs-server-s2s.yellowblue.io
URL: https://cs-server-s2s.yellowblue.io/sync-iframe?redirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Drise.com%26id%3D%7BpartnerId%7D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://cs-server-s2s.yellowblue.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
233
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:41 GMT
etag
"40010-119-5ec73a0a33d00"
last-modified
Wed, 02 Nov 2022 02:30:44 GMT
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Tue, 20 Jun 2023 19:44:41 GMT
location
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
server
AkamaiGHost
djxmvumgbmaplf92fmho.mp4
cdn.taboola.com/libtrc/static/video/v1679570880/ 		465 KB
466 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1679570880/djxmvumgbmaplf92fmho.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a033870063ffdcdc1b7842eec37e0e5ab4a66f5d0788eef0bea2f710b1c3c0d5

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
HBi6suhi.hwH.ILTTagPF3huf2AQDLFJ
date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 varnish
x-amz-request-id
WZS0037Z85V7Z06E
age
80
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-476104/476105
x-amz-replication-status
COMPLETED
Content-Length
476105
x-amz-id-2
XPWOSg2KcPG8wh9pCbZw/tUOJoPhMZN0lGOv0ISSsi5X5MFvBDKBUIROeTENqQSkH5VWzwrsz2Q=
x-served-by
cache-yul12823-YUL
last-modified
Thu, 23 Mar 2023 11:28:08 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290281.977495,VS0,VE4
etag
"7f2d130be8734a174428106a856a5517"
content-type
video/mp4;codecs=avc1
abp
52
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
hhmin4panzq32yprgu70.mp4
cdn.taboola.com/libtrc/static/video/v1670403161/ 		227 KB
227 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1670403161/hhmin4panzq32yprgu70.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2f092f236f905de588f781555bffe9b9fba9e85a3bb451441ca86fd8ef9a01ff

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
s1mLEVq22HiI9F7ZGwjPUpMskS_LfNnh
date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 varnish
x-amz-request-id
WQ2W3XM3TPS6YQPJ
age
73
x-cache
HIT
Content-Range
bytes 0-232274/232275
x-amz-replication-status
COMPLETED
Content-Length
232275
x-amz-id-2
IcpvFUz0PUdHg0hxuNwoP9jgZ7C7Tz3ljy5ynQbBz8H9/O/q6pLE9HwUbzNv8A9SZZkHrLIbEck=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 07 Dec 2022 08:52:46 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290281.977126,VS0,VE1
etag
"512c3d32954a5623da5f98b4c4e550e0"
content-type
video/mp4;codecs=avc1
abp
51
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
jfy5yp77cohy74fsw5uk.mp4
cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/ 		67 KB
67 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video//h_400,c_scale/v1675413952/jfy5yp77cohy74fsw5uk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5af7f54e4682da1be1484f658f9b15a84537085a4081cef229704a6d8e4ceb71

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
JhpPlUz7nZ57ILPZKofZM6pneMKKR0I4
date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 varnish
x-amz-request-id
D3FA3P6X7SQ7DC27
age
88
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-68339/68340
x-amz-replication-status
COMPLETED
Content-Length
68340
x-amz-id-2
eJPfgBRMRFaaYjnMKEy2osdHu6mWqmpQFIXTxUgQkkLIfK6wRnJnYXH1qN43RrKSoemeezPPN9w=
x-served-by
cache-yul12823-YUL
last-modified
Fri, 03 Feb 2023 08:45:58 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290281.977058,VS0,VE1
etag
"12d66db772be5305a2eda235f0b44b99"
content-type
video/mp4;codecs=avc1
abp
39
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
dnbksjfr9whkc3iezepw.mp4
cdn.taboola.com/libtrc/static/video/v1651669819/ 		247 KB
248 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1651669819/dnbksjfr9whkc3iezepw.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b2ac16b228712faf976cdd913df75af40fd04cb4377808ce7f5d9ac091303592

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
TpyK5tKmV6zFQiNaY6BO7yl1WPpuDgHz
date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 varnish
x-amz-request-id
YRP5SW4SZNMW18Z9
age
17
x-cache
HIT
Content-Range
bytes 0-253403/253404
x-amz-replication-status
COMPLETED
Content-Length
253404
x-amz-id-2
JfNWeIG1wv5k5xBdWDvW947i0fb4ByY/ZAH1khMaoEXXmS+vYJk8DgrRo1IID1fpIYywtzLVpOE=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 04 May 2022 13:10:25 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290281.977425,VS0,VE1
etag
"dcbb2da1ae87141fc4afaec988a228ad"
content-type
video/mp4;codecs=avc1
abp
16
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
cktcnyyudrurusyfjouk.mp4
cdn.taboola.com/libtrc/static/video/v1685950230/ 		1 MB
0 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1685950230/cktcnyyudrurusyfjouk.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
d6ueGktFcB2EwN7zocuabc2gAAuw1YPA
date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 varnish
x-amz-request-id
QF7J1Y53HJS926GS
age
43
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-1248084/1248085
x-amz-replication-status
COMPLETED
Content-Length
1248085
x-amz-id-2
AdisWrdtRQdFmzLV3/61Tb4gSYFRPu6s+oI+p/lCbUUx3WIbXNg316yBk1w8PkwZILDvBb78qKU=
x-served-by
cache-yul12823-YUL
last-modified
Mon, 05 Jun 2023 07:30:39 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290281.978036,VS0,VE1
etag
"e73e901218df8f12f0d31914663c3397"
content-type
video/mp4;codecs=avc1
abp
35
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
ae0ue1jbcjqu5byivgsm.mp4
cdn.taboola.com/libtrc/static/video/v1682562179/ 		463 KB
464 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/v1682562179/ae0ue1jbcjqu5byivgsm.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
03d9c6282533912a324c1d6f7c0c06583bed3f2c3a4a2331a6c36df3602faf52

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
1kIG7nplrGZPIHeqvx4bs.wW29YRS385
date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 varnish
x-amz-request-id
DA2E1JF243MYTFAP
age
112
x-amz-server-side-encryption
AES256
x-cache
HIT
Content-Range
bytes 0-474042/474043
x-amz-replication-status
COMPLETED
Content-Length
474043
x-amz-id-2
tDZ397Boo/58rYdcxjTgy7+Sezl//JOwq9xnMDPTZaYRZL7sCEeg9NuBgxAeK+DC4jQRlMZulr8=
x-served-by
cache-yul12823-YUL
last-modified
Thu, 27 Apr 2023 02:23:05 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290281.977884,VS0,VE1
etag
"f3a359ea66d151486ab4c08935a18108"
content-type
video/mp4;codecs=avc1
abp
28
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
fo1n9cyehn4udxz1pco5.mp4
cdn.taboola.com/libtrc/static/video/t_PERFORMANCE_VIDEO_DEFAULT/v1624356367/ 		758 KB
759 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/static/video/t_PERFORMANCE_VIDEO_DEFAULT/v1624356367/fo1n9cyehn4udxz1pco5.mp4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
eae680a0310650963eb8117946e1b91a75a1e2889b547572e2624aba3afbc3eb

Request headers

Referer
https://www.mercurynews.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Range
bytes=0-

Response headers

x-amz-version-id
EbhNmp3yB2TBCvlVWv.7CzZBqFnFkb3C
date
Tue, 20 Jun 2023 19:44:40 GMT
via
1.1 varnish
x-amz-request-id
44V53R7Z6X6XTDCX
age
8
x-cache
HIT
Content-Range
bytes 0-776169/776170
x-amz-replication-status
COMPLETED
Content-Length
776170
x-amz-id-2
2gL2QcxOXkZQDqfru3izsPomTRx58PrF1Ac/cD0wlR+urYE4+UoyrGoPIlu/I8MJZdNk4XthcV8=
x-served-by
cache-yul12823-YUL
last-modified
Tue, 22 Jun 2021 10:06:42 GMT
server
AmazonS3
x-tbl-debug
bestatus=200,beresp=OK
x-timer
S1687290281.977859,VS0,VE1
etag
"10f38704cb7da976bf646d36d8f12f73"
content-type
video/mp4;codecs=avc1
abp
4
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
0
pixel
cm.g.doubleclick.net/ Frame 25E2 		170 B
243 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV81MDVkYWRkYi1iOWYzLTRlZmYtYTdhNi0yNWM4NDJjMDUxMmQ=&gdpr=0&gdpr_consent=&google_redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dgdv
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
170
content-type
image/png
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:41 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
server
HTTP server (unknown)
x-xss-protection
0
usersync
usersync.gumgum.com/ Frame 8AB4
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=gumgum
  • https://usersync.gumgum.com/usersync?b=sus&i=ZJIBqcCo5ukAAJLgBKoAAAAA
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=sus&i=ZJIBqcCo5ukAAJLgBKoAAAAA
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:41 GMT
Expires
0
Pragma
no-cache

Redirect headers

Cache-Control
private
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:41 GMT
Location
https://usersync.gumgum.com/usersync?b=sus&i=ZJIBqcCo5ukAAJLgBKoAAAAA
P3P
CP="See also http://www.scaleout.jp/privacy/"
Server
nginx
X-SO-Ads-Time
3
X-SO-Cluster-ID
0
X-SO-HostName
a-ad40020.dc2p.scaleout.jp
X-SO-IP
149.56.153.187
X-SO-Key
ZJIBqcCo5ukAAJLgBKoAAAAA
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":0,"gdpr":false,"ipv4":"149.56.153.187","key":"ZJIBqcCo5ukAAJLgBKoAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"a-ad40020"}
X-SO-LB-Hostname
a-tgng40018.dc2p.scaleout.jp
X-SO-Upstream-ID
a-ad40020
gumgum
cs.admanmedia.com/sync/ Frame 4EAC 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://cs.admanmedia.com/sync/gumgum?puid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Daad%26i%3D%5BDSP_USER_ID%5D&gdpr=0&gdpr_consent=&ccpa=
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
80.77.87.161 Clifton, United States, ASN46636 (NATCOWEB, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Frame-Options DENY

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:41 GMT
Server
nginx
Strict-Transport-Security
max-age=63072000; includeSubdomains; preload
X-Frame-Options
DENY
usermatchredir
ssum-sec.casalemedia.com/ Frame 0C21 		43 B
766 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum-sec.casalemedia.com/usermatchredir?s=189872&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Diex%26i%3D
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:41 GMT
Expires
0
Keep-Alive
timeout=1, max=497
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
usersync
usersync.gumgum.com/ Frame CCAB
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=gumgum
  • https://creativecdn.com/cm-notify?pi=gumgum&tc=1
  • https://usersync.gumgum.com/usersync?b=rth&i=RrG2QWcZ9j7dv54OJsuG&pi=gumgum&tc=1
35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=rth&i=RrG2QWcZ9j7dv54OJsuG&pi=gumgum&tc=1
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:41 GMT
Expires
0
Pragma
no-cache

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:41 GMT Tue, 20 Jun 2023 19:44:41 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://usersync.gumgum.com/usersync?b=rth&i=RrG2QWcZ9j7dv54OJsuG&pi=gumgum&tc=1
pragma
no-cache
usync.html
eus.rubiconproject.com/ Frame 6EFE
Redirect Chain
  • https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
  • https://eus.rubiconproject.com/usync.html?p=gumgum
281 B
554 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by
Host: rtb.gumgum.com
URL: https://rtb.gumgum.com/usync/amzns2s?r=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dgg.com%26id%3D&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://rtb.gumgum.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
233
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:41 GMT
ETag
"40010-119-5ec73a0a33d00"
Last-Modified
Wed, 02 Nov 2022 02:30:44 GMT
Server
Apache/2.2.15 (CentOS)
Vary
Accept-Encoding

Redirect headers

access-control-allow-credentials
true
access-control-allow-origin
*
content-length
0
date
Tue, 20 Jun 2023 19:44:41 GMT
location
https://eus.rubiconproject.com/usync.html?p=gumgum
server
AkamaiGHost
log
protected-by.clarium.io/ Frame 389B 		0
0
log
protected-by.clarium.io/ Frame 389B 		0
222 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.107.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-107-2.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 389B 		0
0
log
protected-by.clarium.io/ Frame 4CED 		0
0
log
protected-by.clarium.io/ Frame 4CED 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.107.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-107-2.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 4CED 		0
0
sync
gum.criteo.com/ Frame B7E7 		78 B
318 B 		Script
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
94fee7717069b4c601d1eda72a12f82cd10354f59b9766a92536983d1b7ab0c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=3600
server-processing-duration-in-ticks
920934
expires
60
ttj
secure.adnxs.com/ Frame B7E7 		5 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.adnxs.com/ttj?ttjb=1&bdc=1687290280&bdh=4YGpoc_Pn8xxeMkz6ivNXYOr92Q.&&bdref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F,https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&&id=28334192
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.179.89 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
32f365b7f2196ed2d801e5b6570e160b72767a2fa3ec58b516955e5b3caccba3
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:41 GMT
Content-Encoding
gzip
X-Creative-ID
398539822
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
58ba94a2-1060-4077-9fae-4493ca51ad64
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
www.google.com/pagead/1p-user-list/11039244145/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/11039244145/?random=1687290279007&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&fmt=3&is_vtc=1&random=3093199654&rmt_tld=0&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/11039244145/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/11039244145/?random=1687290279007&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Daudio_article_loaded%3Bevent_category%3DAudio%20Article%3Bevent_label%3DAudio%20Article%20Player&fmt=3&is_vtc=1&random=3093199654&rmt_tld=1&ipr=y
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
352 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-61435456-5&cid=461448689.1687290279&jid=1411866594&gjid=1068003052&_gid=183842644.1687290279&_u=aCDACEAiBAAAACgFK~&z=144939718
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c08::9d Ashburn, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:44:41 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
a-04i4
i.liadm.com/s/c/ Frame E3FE 		1 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.92.222.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-92-222-20.compute-1.amazonaws.com
Software
/
Resource Hash
42d8c6aea646efc28475231137b1fdd1e216d02563c548fd789e9ae7ae5f8e65
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-cache, max-age=0
Connection
keep-alive
Content-Encoding
gzip
Content-Length
678
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Jun 2023 19:44:41 GMT
Request-Time
11
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
abtests
us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/ 		0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-trc-events.taboola.com/medianewsgroup-mercurynews/log/3/abtests?route=US:US:V&tvi2=4948&lti=deflated&ri=8d085e89d617fae9291e8f1de6452eb6&sd=v2_cfa7831abef4b97bcc73077b9207f316_1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726_1687290278_1687290278_CNawjgYQtdRXGNjj2dKNMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB&ui=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&pi=/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc&wi=-768682263354384656&pt=text&vi=1687290278360&d=%7B%22abTestsEventType%22%3A%22simple%22%2C%22name%22%3A%22feed-distance-from-article-end%22%2C%22type%22%3A%22932.453125%22%2C%22eventTime%22%3A1687290281458%7D&tim=19%3A44%3A41.459&id=5524&llvl=2&cv=20230620-6-RELEASE&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
usync.js
eus.rubiconproject.com/ Frame 6EFE 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
content-encoding
gzip
last-modified
Tue, 20 Jun 2023 08:41:09 GMT
server
Apache/2.2.15 (CentOS)
x-powered-by
PHP/5.3.3
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control
max-age=46564
content-length
10113
expires
Wed, 21 Jun 2023 08:40:45 GMT
usync.js
eus.rubiconproject.com/ Frame 3828 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
content-encoding
gzip
last-modified
Tue, 20 Jun 2023 08:41:09 GMT
server
Apache/2.2.15 (CentOS)
x-powered-by
PHP/5.3.3
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control
max-age=46564
content-length
10113
expires
Wed, 21 Jun 2023 08:40:45 GMT
rtb-h
sync.taboola.com/sg/supershiprtb-display-network/1/ Frame 0C79
Redirect Chain
  • https://tg.socdm.com/aux/idsync?proto=taboola
  • https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBqcCo5ukAAJLgBLwAAAAA
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBqcCo5ukAAJLgBLwAAAAA
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
25708

Redirect headers

X-SO-Cluster-ID
0
Date
Tue, 20 Jun 2023 19:44:41 GMT
X-SO-LB-Data
{"ban":false,"clean_query":"\/aux\/idsync?proto=taboola","cluster_id":0,"gdpr":false,"ipv4":"149.56.153.187","key":"ZJIBqcCo5ukAAJLgBLwAAAAA","privacy_sensitive":false,"uid":"","upstream_id":"m-ad1009"}
X-SO-Key
ZJIBqcCo5ukAAJLgBLwAAAAA
Server
nginx
X-SO-Upstream-ID
m-ad1009
P3P
CP="See also http://www.scaleout.jp/privacy/"
Location
https://sync.taboola.com/sg/supershiprtb-display-network/1/rtb-h?taboola_hm=ZJIBqcCo5ukAAJLgBLwAAAAA
Cache-Control
private
X-SO-HostName
m-ad1009.dc4p.scaleout.jp
Connection
keep-alive
X-SO-Ads-Time
1
Content-Length
0
X-SO-LB-Hostname
a-tgng40018.dc2p.scaleout.jp
X-SO-IP
149.56.153.187
/
sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/ Frame 0C79
Redirect Chain
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__
  • https://ih.adscale.de/su?gdpr=0&gdpr_consent=&tpid=22688&cburl=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fstroerrtbeur-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D__STROEER_USER_ID__&nut&uu=6fadbf2f9c8147e5be...
  • https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=6fadbf2f9c8147e5bed870a0b19b7fb3
0
221 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=6fadbf2f9c8147e5bed870a0b19b7fb3
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
30288

Redirect headers

location
https://sync.taboola.com/sg/stroerrtbeur-network/1/rtb-h/?taboola_hm=6fadbf2f9c8147e5bed870a0b19b7fb3
date
Tue, 20 Jun 2023 19:44:42 GMT
content-length
0
sync
ssbsync.smartadserver.com/api/ Frame 0C79 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssbsync.smartadserver.com/api/sync?callerId=4
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.105.12.143 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
/
sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/ Frame 0C79
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698
  • https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4P2F0B-P-LXKJ
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4P2F0B-P-LXKJ
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
25708

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://sync.taboola.com/sg/rubiconvideo-network/1/rtb-h/?taboola_hm=LJ4P2F0B-P-LXKJ
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
b9bd3ce43b0f5c29a708abe94979ac15
Expires
0
/
sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/ Frame 0C79
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/taboola/1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726?gdpr=0&gdpr_consent=&us_privacy=1---
  • https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ft3eHrRE2oThAXdKHDLJBA.ObW.vE1pYFz.WDA--~A
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ft3eHrRE2oThAXdKHDLJBA.ObW.vE1pYFz.WDA--~A
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
24545

Redirect headers

date
Tue, 20 Jun 2023 19:44:41 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://sync.taboola.com/sg/yahoodsprtb-network/1/rtb-h/?taboola_hm=y-ft3eHrRE2oThAXdKHDLJBA.ObW.vE1pYFz.WDA--~A
content-length
0
/
sync.taboola.com/sg/baidurtb-network/1/rtb-h/ Frame 0C79
Redirect Chain
  • https://trace.mediago.io/ju/cs/taboola
  • https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=883b8c2c02f36ac778b5c1a5e5678e71
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=883b8c2c02f36ac778b5c1a5e5678e71
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
25708

Redirect headers

location
https://sync.taboola.com/sg/baidurtb-network/1/rtb-h/?taboola_hm=883b8c2c02f36ac778b5c1a5e5678e71
date
Tue, 20 Jun 2023 19:44:41 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8
content-type
text/plain; charset=utf-8
/
trc.taboola.com/sg/google-network/1/rtb-h/ Frame 0C79
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEDt8YPLwaBPduBVy5g3Vg4Y&google_cver=1
0
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEDt8YPLwaBPduBVy5g3Vg4Y&google_cver=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
10
date
Tue, 20 Jun 2023 19:44:41 GMT
via
1.1 varnish
x-served-by
cache-yul12823-YUL
server
nginx
x-timer
S1687290282.948767,VS0,VE10
x-fastly-to-nlb-rtt
12063
x-cache
MISS
accept-ranges
bytes
content-length
0
x-service-version
v2
x-cache-hits
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEDt8YPLwaBPduBVy5g3Vg4Y&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
304
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sync
sync-pm.ads.yieldmo.com/ Frame 0C79
Redirect Chain
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726:$UID
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=160648&pmc=1&pr=https%3A%2F%2Fsync-pm.ads.yieldmo.com%2Fsync%3Fpn_id%3Dpub%26id%3D479CC621-B2E0-490D-8915-42055EBBC0EB%26gdpr%3D0%26gdpr_consent%3D
  • https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
43 B
685 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
52.203.194.180 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-203-194-180.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

location
https://sync-pm.ads.yieldmo.com/sync?pn_id=pub&id=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
pixel
cm.g.doubleclick.net/ Frame 0C79
Redirect Chain
  • https://sync.taboola.com/sg/google-network/1/rtb/?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
date
Tue, 20 Jun 2023 19:44:41 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
24976
/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame 0C79
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=db51a350-c421-4780-94b8-db6155d007ec
0
306 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=db51a350-c421-4780-94b8-db6155d007ec
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-vcl-time-ms
10
date
Tue, 20 Jun 2023 19:44:41 GMT
via
1.1 varnish
x-served-by
cache-yul12823-YUL
server
nginx
x-timer
S1687290282.937281,VS0,VE10
x-fastly-to-nlb-rtt
9036
x-cache
MISS
accept-ranges
bytes
content-length
0
x-service-version
v2
x-cache-hits
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=db51a350-c421-4780-94b8-db6155d007ec
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
239
merge
ce.lijit.com/ Frame 0C79 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=42&3pid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&us_privacy=1---&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.92.190.69 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:41 GMT
P3P
CP="CUR ADM OUR NOR STA NID"
Content-Type
image/gif
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap3ewr1
Content-Length
43
Expires
Fri, 20 Mar 2009 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame 0C79 		49 B
905 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=553204&ev=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.139 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(10.0.14) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
content-type
image/gif;charset=iso-8859-1
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
/
rtb-csync.smartadserver.com/redir/ Frame 0C79 		43 B
438 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=107&partneruserid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 0C79
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40
  • https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=fbc3b4d9-a11b-4371-a88d-35e24043ca77
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=fbc3b4d9-a11b-4371-a88d-35e24043ca77
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
25708

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=fbc3b4d9-a11b-4371-a88d-35e24043ca77
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1440038
content-length
0
expires
Tue, 20 Jun 2023 00:00:00 GMT
/
sync.taboola.com/sg/id5-network/1/rtb-h/ Frame 0C79
Redirect Chain
  • https://id5-sync.com/s/464/9.gif?puid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D...
  • https://id5-sync.com/c/464/464/7/1.gif?puid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&gdpr=0&gdpr_consent=&us_privacy=
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F3%2F6%2F2.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26g...
  • https://id5-sync.com/c/464/3/6/2.gif?puid=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
  • https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F108%2F5%2F3.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
  • https://id5-sync.com/c/464/108/5/3.gif?puid=6e633baa-8f35-487f-a052-7b9fb224da66&gdpr=0&gdpr_consent=
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F429%2F4%2F4.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
  • https://id5-sync.com/c/464/429/4/4.gif?puid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/264.gif?puid=db51a350-c421-4780-94b8-db6155d007ec&ttl=%%TTL%%
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/464/2/2/6.gif?puid=$UID&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/464/2/2/6.gif?puid=3321274862842215126&gdpr=0&gdpr_consent=
  • https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F1%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F112%2F1%2F7.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/464/112/1/7.gif?puid=885894C13F35428C&gdpr=0&gdpr_consent=
  • https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F441%2F0%2F8.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/464/441/0/8.gif?puid=u_505daddb-b9f3-4eff-a7a6-25c842c0512d&gdpr=0&gdpr_consent=
  • https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A
0
231 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
28294

Redirect headers

location
https://sync.taboola.com/sg/id5-network/1/rtb-h/?taboola_hm=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A
date
Tue, 20 Jun 2023 19:44:44 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding
chunked
p3p
CP="CAO PSA OUR"
rtb-h
sync-t1.taboola.com/sg/bidswitch-network/1/ Frame 0C79
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://inv-nets.admixer.net/adxcm.aspx?ssp=D41B0D84-4DB7-4D9C-81CC-3A497DB5D0A6&gdpr=0&consent=&rurl=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D354%26user_id%3D%24%24visitor_cookie%24%24%26ssp%3Dtabo...
  • https://x.bidswitch.net/sync?dsp_id=354&user_id=3e3e5b7a69bb4c839bc23ca0143ab614&ssp=taboola&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&consent=&gdpr_pd=&expires=7
  • https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
30288

Redirect headers

Location
//sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=&gdpr_pd=&us_privacy=
Date
Tue, 20 Jun 2023 19:44:42 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
rtb-h
match.taboola.com/sg/mediaforcebidder-network/1/ Frame 0C79
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=taboola
  • https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=45f36b13-857c-4e12-af33-6a514e9bfc45
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=45f36b13-857c-4e12-af33-6a514e9bfc45&tbid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&query=taboola_hm%3D45f36b13-857c-...
0
77 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=45f36b13-857c-4e12-af33-6a514e9bfc45&tbid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&query=taboola_hm%3D45f36b13-857c-4e12-af33-6a514e9bfc45&isDirect=0
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-cache-hits
0
date
Tue, 20 Jun 2023 19:44:42 GMT
via
1.1 varnish
server
nginx
x-timer
S1687290282.079896,VS0,VE10
x-cache
MISS
accept-ranges
bytes
content-length
0
x-served-by
cache-yul12823-YUL

Redirect headers

location
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=45f36b13-857c-4e12-af33-6a514e9bfc45&tbid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&query=taboola_hm%3D45f36b13-857c-4e12-af33-6a514e9bfc45&isDirect=0
date
Tue, 20 Jun 2023 19:44:41 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
24545
sd
u.openx.net/w/1.0/ Frame 0C79 		43 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://u.openx.net/w/1.0/sd?id=543998486&val=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT
xuid
eb2.3lift.com/ Frame 0C79 		37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=7772&xuid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&dongle=tbla&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
rtb-h
sync.taboola.com/sg/stackadaptrtb-network/1/ Frame 0C79
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=140
  • https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=ruPoSpZIUIJ7GLwbam2kAZU4mbs
0
221 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=ruPoSpZIUIJ7GLwbam2kAZU4mbs
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
25708

Redirect headers

Location
https://sync.taboola.com/sg/stackadaptrtb-network/1/rtb-h?taboola_hm=ruPoSpZIUIJ7GLwbam2kAZU4mbs
Date
Tue, 20 Jun 2023 19:44:41 GMT
Connection
keep-alive
Content-Length
119
Content-Type
text/html; charset=utf-8
sync
t.adx.opera.com/ Frame 0C79 		35 B
467 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.adx.opera.com/sync?vendor=60151&uid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
82.145.213.8 , Norway, ASN39832 (NO-OPERA, NO),
Reverse DNS
n-sysadmin-jumpbox-03.feednews.opera.technology
Software
Tengine /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
server
Tengine
access-control-allow-methods
POST, GET
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
/
sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/ Frame 0C79
Redirect Chain
  • https://u.openx.net/w/1.0/cm?gdpr=0&gdpr_consent=&ph=295bf259-a378-4089-aae8-a2a995ba8627&id=37f45540-fa88-4005-bf73-8a7ac39467e3&r=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fopenxrtb-network%2F1%2Fr...
  • https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=a33e8f29-3377-4897-8dda-1952a3cf5165
0
230 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=a33e8f29-3377-4897-8dda-1952a3cf5165
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
25144

Redirect headers

date
Tue, 20 Jun 2023 19:44:41 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://sync-t1.taboola.com/sg/openxrtb-network/1/rtb-h/?gdpr=0&us_privacy=1---&orig=video&taboola_hm=a33e8f29-3377-4897-8dda-1952a3cf5165
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
cds-pips.js
cdn.taboola.com/scripts/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/scripts/cds-pips.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e7d49f24d56db02c7baca8ae3a17555c2e527571450e8c24c77b453407e267a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
z5FoayaLm_Bvew3pbkytkoHczFCvkPwT
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:41 GMT
x-amz-request-id
ZAK4FD2E2P8MSSD3
age
298
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
1340
x-amz-id-2
V0c8gILtYp37FWXhcXdQojKeSQFpHITDXRHuVnvWCLK7rCdcoYnpLZyoXbDe/nSz/8OPQX7zNUM=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 12 Oct 2022 13:57:57 GMT
server
AmazonS3
x-timer
S1687290282.578873,VS0,VE0
etag
"383fa66d2a0a09f4a6e64a9593ad43bb"
vary
Accept-Encoding
content-type
application/javascript
abp
61
access-control-allow-origin
*
cache-control
private, max-age=3600
accept-ranges
bytes
x-cache-hits
1543
fraud-detect.js
cdn.taboola.com/scripts/ 		121 B
418 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/scripts/fraud-detect.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
392c32f20b9f867852a946a6ed1c5e21476df9619083548b6585d80a3b5f9bd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
vOXBAr_FxKHpU348.XTQhP6DWnVyKple
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:41 GMT
x-amz-request-id
Q3ERA9VTRD55JBY1
age
22405
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
125
x-amz-id-2
UUMJVpvIZIvyQ22D+SDZRaO7/6yI3tG7JsuWzRq09Cf8ExmuPRI8X1vhSkWaCi+MY3QYN59kQmA=
x-served-by
cache-yul12823-YUL
last-modified
Thu, 15 Dec 2022 16:50:08 GMT
server
AmazonS3
x-timer
S1687290282.581997,VS0,VE0
etag
"f7a185d92ac2162dc0bc36c5d7ef7dfe"
vary
Accept-Encoding
content-type
application/javascript
abp
15
access-control-allow-origin
*
cache-control
private,max-age=14400
accept-ranges
bytes
x-cache-hits
86358
eidf.es5.js
cdn.taboola.com/scripts/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/scripts/eidf.es5.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
3979WkHCSLO5cQCJAWoE4w7tW4Dv40AW
content-encoding
gzip
via
1.1 varnish
date
Tue, 20 Jun 2023 19:44:41 GMT
x-amz-request-id
MDF5YJ4JPHMV135K
age
21189
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
6467
x-amz-id-2
/0TARI9ylAJTtdJm2wdojYI6Jg6CZKI/p48bHg5JJJxgG8TBC90GLh4JuJBP312yN5EOCZz5/3Q=
x-served-by
cache-yul12823-YUL
last-modified
Sun, 02 Apr 2023 13:49:08 GMT
server
AmazonS3
x-timer
S1687290282.584671,VS0,VE0
etag
"2fdf3e79d5e851201a0d52a886453d8b"
vary
Accept-Encoding
content-type
application/javascript
abp
26
access-control-allow-origin
*
cache-control
private,max-age=14400
accept-ranges
bytes
x-cache-hits
109580
PugMaster
image6.pubmatic.com/AdServer/ Frame 738D 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=809553&p=156011&s=165626&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
bf75e6945384ed8e4f8f260cb4953b0b9ad49411c16a4a73b0eed12d2a857fff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Tue, 20 Jun 2023 19:44:41 GMT
content-length
1633
content-type
text/html; charset=UTF-8
publishertag.prebid.135.js
static.criteo.net/js/ld/ 		89 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.135.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Fri, 24 Feb 2023 07:57:32 GMT
server
nginx
etag
W/"63f86dec-16386"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:41 GMT
ga-audiences
www.google.com/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-61435456-5&cid=461448689.1687290279&jid=1411866594&_u=aCDACEAiBAAAACgFK~&z=920018947
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.ca/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-61435456-5&cid=461448689.1687290279&jid=1411866594&_u=aCDACEAiBAAAACgFK~&z=920018947
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
integrator.js
adservice.google.com/adsid/ 		107 B
165 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2291221096554844&correlator=486534865580128&eid=31075065%2C31075399%2C31075487&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=6&adks=1140109686&didk=1622125026&sfv=1-0-40&ris=2&rcs=1&prev_scp=pos%3DSponsorship_1%26confiant_refresh%3Dtrue%26htl_refresh%3D1&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D236787765623%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D2a155da8dea23fa8%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_MZag-KaHfPvInqD3jUyqai_PEpSaw&gpic=UID%3D00000c52bd207673%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_Ma5lMtSzeU4G6-9L7c_E3E1qQ58Kg&abxe=1&dt=1687290281897&lmt=1687290281&dlt=1687290276662&idt=1385&adxs=3085&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=300x50&msz=300x50&fws=3076&ohw=1254&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvj90cD2IStBPePV2sU5XIZEsMBGkm5YuxQS6jiD838Iv3JaJi0pJmR-WBBxBdM_tb-RL2AkYWZf6FZVZvXTlxDnrsCfKOgg&ga_vid=461448689.1687290279&ga_sid=1687290280&ga_hid=1059800600&ga_fc=true&a3p=EhkKCnVpZGFwaS5jb20Y7OHZ0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjg6dnSjTFIAFICCGoSGQoKcHViY2lkLm9yZxje5dnSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y7OHZ0o0xSABSAghk
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9de51f3e852115d698f0dbaa4fcb534be995f2f3aafbdbd04165a8ccf5bacf5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13308
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
28292
i6.liadm.com/s/ Frame E3FE
Redirect Chain
  • https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D&us_privacy=1---
  • https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=2889108176641716303&us_privacy=1---
  • https://dis.criteo.com/dis/usersync.aspx?r=77&p=311&cp=liveintent&cu=1&url=https://i.liadm.com/s/28292?bidder_id%3D71340%26bidder_uuid%3D@@CRITEO_USERID@@&us_privacy=1---
  • https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-9-UvyEmtihn86JfTZG0fWnuLfwac5-se2Drtlg&us_privacy=1---
  • https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-9-UvyEmtihn86JfTZG0fWnuLfwac5-se2Drtlg&us_privacy=1---&us_privacy=1---
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-9-UvyEmtihn86JfTZG0fWnuLfwac5-se2Drtlg&us_privacy=1---&us_privacy=1---
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
2600:1f18:ed:550e:4106:3062:270c:cbbd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:42 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
1
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-9-UvyEmtihn86JfTZG0fWnuLfwac5-se2Drtlg&us_privacy=1---&us_privacy=1---
Date
Tue, 20 Jun 2023 19:44:42 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
3
362358.gif
idsync.rlcdn.com/ Frame E3FE
Redirect Chain
  • https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=7130a7b6-bb6a-4db6-8b12-3801a087cf17&us_privacy=1---
  • https://p.rfihub.com/cm?pub=39342&in=1&userid=5a991fdb-988c-4f1f-9a42-ecad99d56781%3A1687290282.0281818&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D5a991fdb-988c-4f1f-9a42-ecad99d...
  • https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=968625788422591216&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D5a991fdb-988c-4f1f-9a4...
  • https://idsync.rlcdn.com/501709.gif?partner_uid=5a991fdb-988c-4f1f-9a42-ecad99d56781%3A1687290282.0281818&_=1687290282.0328426
  • https://idsync.rlcdn.com/1000.gif?memo=CM3PHhJBCj0IARAFGjc1YTk5MWZkYi05ODhjLTRmMWYtOWE0Mi1lY2FkOTlkNTY3ODE6MTY4NzI5MDI4Mi4wMjgxODE4EAAaDQiqg8ikBhIFCOgHEABCAEoA
  • https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
  • https://idsync.rlcdn.com/362358.gif?google_gid=CAESED9wGh0U6jrfnkp2GSxdIF4&google_cver=1
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/362358.gif?google_gid=CAESED9wGh0U6jrfnkp2GSxdIF4&google_cver=1
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://idsync.rlcdn.com/362358.gif?google_gid=CAESED9wGh0U6jrfnkp2GSxdIF4&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
289
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
52164
i.liadm.com/s/ Frame E3FE
Redirect Chain
  • https://x.bidswitch.net/syncd?dsp_id=256&user_group=2&user_id=7130a7b6-bb6a-4db6-8b12-3801a087cf17&redir=//i.liadm.com/s/52176?bidder_id%3D5298%26bidder_uuid%3D$%7BBSW_UID%7D&us_privacy=1---
  • https://i.liadm.com/s/52176?bidder_id=5298&bidder_uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://x.bidswitch.net/sync?ssp=liveintent&user_id=7130a7b6-bb6a-4db6-8b12-3801a087cf17
  • https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=liveintent
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=24&bidswitch_ssp_id=liveintent
  • https://x.bidswitch.net/sync?dsp_id=70&user_id=1235390588561432912&ssp=liveintent
  • https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
43 B
641 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
54.92.222.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-92-222-20.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:43 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
1
Content-Type
image/gif

Redirect headers

Location
//i.liadm.com/s/52164?bidder_id=5298&licd=&bidder_uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Date
Tue, 20 Jun 2023 19:44:42 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
35759
i6.liadm.com/s/ Frame E3FE
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=liveintent&ttd_tpi=1&gdpr=0&us_privacy=1---
  • https://i.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db51a350-c421-4780-94b8-db6155d007ec
  • https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db51a350-c421-4780-94b8-db6155d007ec
43 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db51a350-c421-4780-94b8-db6155d007ec
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Server
2600:1f18:ed:550e:4106:3062:270c:cbbd Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:42 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
0
Content-Type
image/gif

Redirect headers

Location
https://i6.liadm.com/s/35759?bidder_id=44489&bidder_uuid=db51a350-c421-4780-94b8-db6155d007ec
Date
Tue, 20 Jun 2023 19:44:42 GMT
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
0
Request-Time
2
img
sync.mathtag.com/sync/ Frame E3FE 		43 B
443 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.mathtag.com/sync/img?mt_exid=36&7130a7b6-bb6a-4db6-8b12-3801a087cf17&us_privacy=1---
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
74.121.140.211 Reston, United States, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MT3 1031 59fd23a master iad iad-pixel-x22 config_version:"1969" /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:42 GMT
Server
MT3 1031 59fd23a master iad iad-pixel-x22 config_version:"1969"
Content-Type
image/gif
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
43
Expires
Tue, 20 Jun 2023 19:44:41 GMT
live_intent_sync
x.dlx.addthis.com/e/ Frame E3FE
Redirect Chain
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=7130a7b6-bb6a-4db6-8b12-3801a087cf17&us_privacy=1---
  • https://x.dlx.addthis.com/e/live_intent_sync?na_exid=7130a7b6-bb6a-4db6-8b12-3801a087cf17&us_privacy=1---&rd=Y
43 B
594 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=7130a7b6-bb6a-4db6-8b12-3801a087cf17&us_privacy=1---&rd=Y
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
H2
Server
104.76.100.229 Secaucus, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-100-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=2628000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Tue, 20 Jun 2023 19:44:42 GMT
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
max-age=0, no-cache, no-store
strict-transport-security
max-age=2628000
content-length
43
content-type
image/gif

Redirect headers

location
https://x.dlx.addthis.com/e/live_intent_sync?na_exid=7130a7b6-bb6a-4db6-8b12-3801a087cf17&us_privacy=1---&rd=Y
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
max-age=0, no-cache, no-store
strict-transport-security
max-age=2628000
content-length
0
expires
Tue, 20 Jun 2023 19:44:42 GMT
ibs:dpid=127444&dpuuid=7130a7b6-bb6a-4db6-8b12-3801a087cf17
dpm.demdex.net/ Frame E3FE 		42 B
941 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=127444&dpuuid=7130a7b6-bb6a-4db6-8b12-3801a087cf17?us_privacy=1---
Requested by
Host: i.liadm.com
URL: https://i.liadm.com/s/c/a-04i4?s=&cim=&ps=true&ls=true&duid=f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz&ppid=0&euns=0&ci=0&version=sc-v0.2.0&nosync=false&monitorExternalSyncs=false&us_privacy=1---&
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.228.89.16 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-228-89-16.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://i.liadm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

DCS
dcs-prod-va6-2-v048-04e5e9987.edge-va6.demdex.com 12 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
3G9U1ETqSAw=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2291221096554844&correlator=3751885023860930&eid=31075065%2C31075399%2C31075487&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Ctop_leaderboard&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=7&adks=142133714&didk=303353385&sfv=1-0-40&ris=2&rcs=1&prev_scp=pos%3Dtop_leaderboard%26confiant_refresh%3Dtrue%26htl_refresh%3D1&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D236787765623%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D2a155da8dea23fa8%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_MZag-KaHfPvInqD3jUyqai_PEpSaw&gpic=UID%3D00000c52bd207673%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_Ma5lMtSzeU4G6-9L7c_E3E1qQ58Kg&abxe=1&dt=1687290281954&lmt=1687290281&dlt=1687290276662&idt=1385&adxs=1515&adys=243&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=970x250&msz=970x250&fws=1028&ohw=1280&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvj90cD2IStBPePV2sU5XIZEsMBGkm5YuxQS6jiD838Iv3JaJi0pJmR-WBBxBdM_tb-RL2AkYWZf6FZVZvXTlxDnrsCfKOgg&ga_vid=461448689.1687290279&ga_sid=1687290280&ga_hid=1059800600&ga_fc=true&a3p=EhkKCnVpZGFwaS5jb20Y7OHZ0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjg6dnSjTFIAFICCGoSGQoKcHViY2lkLm9yZxje5dnSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y7OHZ0o0xSABSAghk
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8cefdd6c8f8a7fe4aa027da148a57d33e34988050b4eb05461f4646661dd9504
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13138
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 957C
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=a9us&gdpr=0&gdpr=0&khaos=LJ4P2F0B-P-LXKJ
  • https://s.amazon-adsystem.com/ecm3?id=LJ4P2F0B-P-LXKJ&ex=d-rubiconproject.com&status=ok&gdpr=0
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?id=LJ4P2F0B-P-LXKJ&ex=d-rubiconproject.com&status=ok&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
19285MMMWK01F6PR9BVQ
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://s.amazon-adsystem.com/ecm3?id=LJ4P2F0B-P-LXKJ&ex=d-rubiconproject.com&status=ok&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
ace9692b4e77bdf741ff63add80edaca
Expires
0
common.js
maps.googleapis.com/maps-api-v3/api/js/53/7a/ 		273 KB
61 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/53/7a/common.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c38bc51d1b1c8db7f2037ae18da46d0fb6733d3e7bee635e160eb73f870d5a6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 14:45:41 GMT
content-encoding
br
x-content-type-options
nosniff
age
17941
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
61560
x-xss-protection
0
last-modified
Thu, 15 Jun 2023 00:18:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 14:45:41 GMT
util.js
maps.googleapis.com/maps-api-v3/api/js/53/7a/ 		164 KB
52 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maps.googleapis.com/maps-api-v3/api/js/53/7a/util.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5ad96953ed9f09eb237595f0947c8a02ebc9b14131cd128fecdfc16bf91297ba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 16:37:26 GMT
content-encoding
br
x-content-type-options
nosniff
age
11236
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
52674
x-xss-protection
0
last-modified
Thu, 15 Jun 2023 00:18:47 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="maps-api-js"
vary
Accept-Encoding, Origin
report-to
{"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 16:37:26 GMT
t.js
sopalk.com/ Frame B7E7 		65 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/t.js?i=qzf6dxi5wc8fiu0hxffwm&cb=1897461687290282110
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-67.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d2cf823ebd1e2d7b0649b99673b599eda7de0e6f83e2ef0d09531576709b0ec8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
R1D2s3Kk5zdoPZnfOnKtnRrfDKgJdfzA
content-encoding
gzip
via
1.1 957a0e737a088bdc07cb5cc9dcc9e826.cloudfront.net (CloudFront)
date
Tue, 20 Jun 2023 16:43:22 GMT
last-modified
Mon, 29 May 2023 16:40:15 GMT
server
AmazonS3
x-amz-cf-pop
EWR53-P1
age
10882
x-amz-server-side-encryption
AES256
etag
W/"79d67edd63b460a375a4fe1a6b64d45f"
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-id
LUa61iDYXVRZ-_CBh1HKHaXUN5UlyudaeTVTm8fuvTCZ7sAB9Z_4tQ==
async_usersync.html
acdn.adnxs.com/dmp/ Frame D0F0 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1922&pub_id=2234281
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46991
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:42 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 290982
X-Served-By
cache-lga13626-LGA, cache-yul12833-YUL
X-Timer
S1687290282.167210,VS0,VE0
trk.js
cdn.adnxs.com/v/s/236/ Frame B7E7 		80 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:42 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27646
Expires
Wed, 19 Jun 2024 19:44:42 GMT
it
nym1-ib.adnxs.com/ Frame B7E7 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&e=wqT_3QKzCqAzBQAAAwDWAAUBCKmDyKQGEOeH1fvkv9n2YRjW9ZOJwbziiy4qNgkAAAECCOg_EQEHNAAA6D8ZAAAAgOtR6D8hERIAKREJADERG7Aw8LDBDTiCD0CCD0gCUK74hL4BWIaMowFgAGi488YBePn7BYABAYoBA1VTRJIFBvReAZgBrAKgAfoBqAEBsAEAuAECwAEEyAEC0AEA2AEA4AEA8AEAigIqdWYoJ2EnLCAyMTk3MjU4LCAwKTt1ZigncicsIDM5ODUzOTgyMiwgMCk7kgLxAyF3azZ1TEFpbm9JSWFFSzc0aEw0QkdBQWdob3lqQVRBQU9BQkFBMGlDRDFEd3NNRU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFhZ0JBN0FCQUxrQnZ0Qk14UUFBNkRfQkFiN1FUTVVBQU9nX3lRR1FMOEdURlpMX1A5a0JBQUFBQUFBQThEX2dBUUQxQVFBQUFBQ1lBZ0NnQWdDMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xPV1UweU9qWXhOekRnQS1sRGlBUUFrQVFBbUFRQndRUUFBQUFBQUFBQUFNa0VBQQkLHEFBRFlCQUR4FZUoQUFBaUFXYU1La0YBDAEBFDhELXhCUQEKCQEId1FVCQkBAQBNGSgMQUFEUi4oAAAyLigAuE9BRi1Na0U4QVhtZ2FzSi1BV0tqb1lCZ2dZRFZWTkVpQVlBa0FZQm1BWUFvUVlBAVs4QUFEb1A2Z0dBYklHSkFrCRMBAQRCRQEGCQEEQmsJCAEBAEMdGEhMZ0dLQS4umgKZASFraERaOVFpNvUBLElhTW93RWdBeWdBTRHdKE9nX09nbE9XVTB5KUkYQkE2VU5KQQ0BDDhEOVINCxBBQUFCWgEGCQEEQmgJCAEBBEJwAQYJAQRCeAkIAQEQQjRBSWsuaAH0NAEu2ALWCeACh5wK6gKCAWh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy-AAwCIAwGQAwCYAxmgAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE5MjIjTllNMjo2MTcw2gQCCAHgBADwBK74hL4BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAACFWWjYBQHgBQHwBQH6BQQIABAAkAYAmAYAuAYAwQYFICwA8D_QBukG2gYWChAJERkBdBAAGADgBgHyBgIIAIAHAYgHAKAHAcgH-fsF0gcNCREoASYI2gcGAV1wGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=16ae8fbaae226d69085a8df4aab62884d2fcb8c6
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
AN-X-Request-Uuid
f8fb5be3-c491-4f93-870a-0bcbce4b295f
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjE1OTUyMjkwMiIsImVidXkiOiIzMTExNzIwODQzIiwiZWFkdiI6IjUyMzM1MDI2MzYiLCJlY2lkIjoiMTM4NDEzNTIwMzUyIiwiZWVudiI6ImoiLCJlcGlkIjoiMjIxMzg1NDYyNDUiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=8e532ab7-3059-4b37-b3e9-cbbd8172b50d&pid=2d10aa57-19ef-4ec0-84a8-3899d30f307c&dtm=1687290282165&qnm=_matherq&visible=1&tabid=40005137-57dc-449b-98c4-09fff3481006&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x10477&tofa=1687290279&vid=1&lvidt=1687290279&duid=1bfd33dc-1dec-4854-b026-244377afad71&fp=967226427&cid=ma23578&mrk=239876506
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:42 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
truncated
/ Frame B7E7 		210 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a0557e5ebe3a2061bb8e557370300a061019d3cea3642a3a08c0267026ffb1e1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
c5fef3ef-3266-468b-b6de-a19a2a91fe3e
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/c5fef3ef-3266-468b-b6de-a19a2a91fe3e
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
publishertag.prebid.js
static.criteo.net/js/ld/ 		94 KB
30 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
bc82310d2b82f3aa74a269e8f679359bda827c649adb41486fd1af268a026ac1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Wed, 31 May 2023 13:09:50 GMT
server
nginx
etag
W/"6477471e-176eb"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:42 GMT
b9pj45k4
sync-tm.everesttech.net/upi/pid/ Frame 13B8 		85 B
259 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
cache-control
no-cache
content-length
85
content-type
image/png
date
Tue, 20 Jun 2023 19:44:42 GMT
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma
no-cache
server
Jetty(9.4.35.v20201120)
via
1.1 varnish
x-cache
MISS
x-cache-hits
0
x-served-by
cache-yul12829-YUL
x-timer
S1687290282.217485,VS0,VE15
Pug
image2.pubmatic.com/AdServer/ Frame 6353
Redirect Chain
  • https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716634525412
42 B
274 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716634525412
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:55:05 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Content-Length
0
Date
Tue, 20 Jun 2023 19:44:42 GMT
Location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=969188716634525412
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server
Jetty(9.4.51.v20230217)
ecm3
s.amazon-adsystem.com/ Frame FF6D 		43 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/ecm3?ex=pubmatic.com&id=PM_UID479CC621-B2E0-490D-8915-42055EBBC0EB
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:42 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
x-amz-rid
KFP1G9XMDVGEQ794TW8V
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 738D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=R5zGIbLgSQ2JFUIFXrvA6w%3D%3D&gdpr=0&gdpr_consent=
  • https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
gzip
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
server
Apache
vary
Accept-Encoding
content-type
text/html
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control
max-age=165959
accept-ranges
bytes
content-length
5554
expires
Thu, 22 Jun 2023 17:50:41 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
301
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
receive
pixel.tapad.com/idsync/ex/ Frame 738D
Redirect Chain
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=479CC621-B2E0-490D-8915-42055EBBC0EB
  • https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3D6e633baa-8f35-487f-a052-7b9fb224da66%252C%252C
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=3321274862842215126&pt=6e633baa-8f35-487f-a052-7b9fb224da66%2C%2C
95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=3321274862842215126&pt=6e633baa-8f35-487f-a052-7b9fb224da66%2C%2C
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H3
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95

Redirect headers

Date
Tue, 20 Jun 2023 19:44:42 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
becaca62-7838-4fd4-adbd-92876dfb1b4e
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=3321274862842215126&pt=6e633baa-8f35-487f-a052-7b9fb224da66%2C%2C
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
xuid
eb2.3lift.com/ Frame 738D 		37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=7976&xuid=479CC621-B2E0-490D-8915-42055EBBC0EB&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
insync
thrtle.com/ Frame 738D
Redirect Chain
  • https://thrtle.com/insync?vxii_pid=10067&vxii_pdid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
  • https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=479CC621-B2E0-490D-8915-42055EBBC0EB&vxii_pid=12&vxii_pid1=10067&vxii_rcid=69245832-6661-449e-82cd-f2fb859b73e0
43 B
294 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=479CC621-B2E0-490D-8915-42055EBBC0EB&vxii_pid=12&vxii_pid1=10067&vxii_rcid=69245832-6661-449e-82cd-f2fb859b73e0
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
34.196.255.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-255-49.compute-1.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI OUR BUS UNI COM NAV"
date
Tue, 20 Jun 2023 19:44:42 GMT
content-length
43
content-type
image/gif

Redirect headers

location
https://thrtle.com/insync?gdpr=0&gdpr_consent=&vxii_pdid=479CC621-B2E0-490D-8915-42055EBBC0EB&vxii_pid=12&vxii_pid1=10067&vxii_rcid=69245832-6661-449e-82cd-f2fb859b73e0
date
Tue, 20 Jun 2023 19:44:42 GMT
content-type
text/html; charset=utf-8
content-length
211
p3p
CP="NOI OUR BUS UNI COM NAV"
Pug
image2.pubmatic.com/AdServer/ Frame 738D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBwVNXZ9auhyOaTXcxEN6nE&google_cver=1
42 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBwVNXZ9auhyOaTXcxEN6nE&google_cver=1
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEBwVNXZ9auhyOaTXcxEN6nE&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
379
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
image2.pubmatic.com/AdServer/ Frame 738D
Redirect Chain
  • https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:8B59A33699C741AFA2C7A091E574C7C9
42 B
328 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:8B59A33699C741AFA2C7A091E574C7C9
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:49:40 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date
Tue, 20 Jun 2023 19:44:42 GMT
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
server
openresty
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/html
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:8B59A33699C741AFA2C7A091E574C7C9
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length
142
expires
Mon, 19 Jun 2023 19:44:42 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 738D
Redirect Chain
  • https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2889108176641716303&gdpr=0&gdpr_consent=&us_privacy=
1 B
273 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2889108176641716303&gdpr=0&gdpr_consent=&us_privacy=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:40 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2889108176641716303&gdpr=0&gdpr_consent=&us_privacy=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:41 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Pug
simage2.pubmatic.com/AdServer/ Frame 738D
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
42 B
392 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
Requested by
Host: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/v3/pr?exlist=gg_n-index_n-MediaNet_smrt_cnv_n-smaato_n-sharethrough_pm-db5_ym_rbd_ppt_kg_an-db5_sovrn_n-Rise_3lift&fv=1.0&a=cm&cm3ppd=1&dmt=3&gdpr=0
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
355
usersync
usersync.gumgum.com/ Frame 6EFE
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&gdpr_consent=undefined&gdpr=0&us_privacy=1---&khaos=LJ4P2F0B-P-LXKJ
  • https://usersync.gumgum.com/usersync?b=mag&i=LJ4P2F0B-P-LXKJ&gdpr=0&gdpr_consent=undefined&us_privacy=1---
35 B
250 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://usersync.gumgum.com/usersync?b=mag&i=LJ4P2F0B-P-LXKJ&gdpr=0&gdpr_consent=undefined&us_privacy=1---
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol
HTTP/1.1
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Expires
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://usersync.gumgum.com/usersync?b=mag&i=LJ4P2F0B-P-LXKJ&gdpr=0&gdpr_consent=undefined&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
b9bd3ce43b0f5c29a708abe94979ac15
Expires
0
cs
cs.yellowblue.io/ Frame 3828
Redirect Chain
  • https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=rise_engage&gdpr_consent=undefined&gdpr=0&us_privacy=1---&khaos=LJ4P2F0B-P-LXKJ
  • https://cs.yellowblue.io/cs?aid=11590&id=LJ4P2F0B-P-LXKJ&gdpr=0&gdpr_consent=undefined&us_privacy=1---
0
325 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cs.yellowblue.io/cs?aid=11590&id=LJ4P2F0B-P-LXKJ&gdpr=0&gdpr_consent=undefined&us_privacy=1---
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=rise_engage&endpoint=us-east
Protocol
H2
Server
3.227.148.228 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-227-148-228.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
server
istio-envoy
access-control-allow-methods
POST, GET, OPTIONS, PUT, DELETE
content-type
application/javascript
access-control-allow-origin
https://eus.rubiconproject.com/
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
access-control-allow-headers
Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-WL-CONF,X-Requested-With
content-length
0

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cs.yellowblue.io/cs?aid=11590&id=LJ4P2F0B-P-LXKJ&gdpr=0&gdpr_consent=undefined&us_privacy=1---
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
ace9692b4e77bdf741ff63add80edaca
Expires
0
setuid
px.ads.linkedin.com/ Frame 957C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=36584&gdpr=0
  • https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ4P2F0B-P-LXKJ&gdpr=0
0
734 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ4P2F0B-P-LXKJ&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
H2
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: A6ECDAF789E540F890DE997DBFCDED8C Ref B: YMQ01EDGE0310 Ref C: 2023-06-20T19:44:42Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX+lOHsII0Mbwukt+DnJw==

Redirect headers

Location
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LJ4P2F0B-P-LXKJ&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
636a4452fa95aad32992c06634d4089f
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
pixel
cm.g.doubleclick.net/ Frame 957C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2249&pt=n&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTE4YTg0M2IwNmJiZGE1MDQ2ODJiMTczMzc3ZWM1OGMyZWFhMDcwMQ&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTE4YTg0M2IwNmJiZGE1MDQ2ODJiMTczMzc3ZWM1OGMyZWFhMDcwMQ&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
H3
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTE4YTg0M2IwNmJiZGE1MDQ2ODJiMTczMzc3ZWM1OGMyZWFhMDcwMQ&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
636a4452fa95aad32992c06634d4089f
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 957C
Redirect Chain
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&expires=30
42 B
722 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&expires=30
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
b9bd3ce43b0f5c29a708abe94979ac15
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&expires=30
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
289
dcm
aax-eu.amazon-adsystem.com/s/ Frame 957C 		43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
67.220.228.202 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
2RA7QHY4H374M6YT70WW
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ecm3
s.amazon-adsystem.com/ Frame 957C
Redirect Chain
  • https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&gdpr=0
  • https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=0ffS7W8KTNOV5T0EkHrr_g&rk=usync-na&gdpr=0
  • https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=0ffS7W8KTNOV5T0EkHrr_g&gdpr=0
43 B
479 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=0ffS7W8KTNOV5T0EkHrr_g&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
Z6JK44SJ3WMKHBX6AF71
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=0ffS7W8KTNOV5T0EkHrr_g&gdpr=0
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
b9bd3ce43b0f5c29a708abe94979ac15
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
tap.php
pixel.rubiconproject.com/ Frame 957C
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc&gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEDFeaR4jdIiG4Hbl8Cz4Cqs&google_cver=1
42 B
702 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEDFeaR4jdIiG4Hbl8Cz4Cqs&google_cver=1
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
ace9692b4e77bdf741ff63add80edaca
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&gdpr=0&put=CAESEDFeaR4jdIiG4Hbl8Cz4Cqs&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
337
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 957C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=25470&gdpr=0
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEo0UDJGMEItUC1MWEtK&gdpr=0
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&gdpr=0&google_gid=CAESEMPX5we3jfJ1ADyBRwg_6f0&google_cver=1
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UDJGMEItUC1MWEtK&google_push=&gdpr=0
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UDJGMEItUC1MWEtK&google_push=&gdpr=0
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
H3
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEo0UDJGMEItUC1MWEtK&google_push=&gdpr=0
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
b9bd3ce43b0f5c29a708abe94979ac15
Expires
0
tap.php
pixel.rubiconproject.com/ Frame 957C
Redirect Chain
  • https://token.rubiconproject.com/token?pid=2974&pt=n&a=1&gdpr=0
  • https://pr-bh.ybp.yahoo.com/sync/rubicon/GFp5IK8Wtlfl9KdDoUK7cQ?csrc=&gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-4zu9LXtE2oJE7rMGoTe_XlqwGXg0BtsZgKmn0A--~A
42 B
702 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-4zu9LXtE2oJE7rMGoTe_XlqwGXg0BtsZgKmn0A--~A
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=a9us&endpoint=us-east&gdpr=0
Protocol
HTTP/1.1
Server
8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
content-length
42
X-RPHost
b9bd3ce43b0f5c29a708abe94979ac15
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date
Tue, 20 Jun 2023 19:44:42 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-4zu9LXtE2oJE7rMGoTe_XlqwGXg0BtsZgKmn0A--~A
content-length
0
/
pips.taboola.com/ 		64 B
244 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pips.taboola.com/
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::300 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
50629fbe7dd47a2baa94f1b35db2ebf4db8493a978ec9c4832a9318a945bcefe

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
cache-yul12832-YUL
date
Tue, 20 Jun 2023 19:44:42 GMT
via
1.1 varnish
server
Varnish
access-control-allow-methods
GET
x-cache
HIT
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-store
accept-ranges
bytes
content-length
64
retry-after
0
x-cache-hits
0
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=ue&ue_na=Ad%20Impression&ue_px=eyJlYWlkIjoiNjE1OTUyMjkwMiIsImVidXkiOiIzMTExNzIwODQzIiwiZWFkdiI6IjUyMzM1MDI2MzYiLCJlY2lkIjoiMTM4NDEzNTIwMzUyIiwiZWVudiI6ImoiLCJlcGlkIjoiMjIxMzg1NDYyNDUiLCJlc2lkIjoiMjQyNTMyMTQifQ&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=b40b128e-bed2-424f-8081-78e90923c33a&pid=2d10aa57-19ef-4ec0-84a8-3899d30f307c&dtm=1687290282173&qnm=_matherq&visible=1&tabid=40005137-57dc-449b-98c4-09fff3481006&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x10477&tofa=1687290279&vid=1&lvidt=1687290279&duid=1bfd33dc-1dec-4854-b026-244377afad71&fp=967226427&cid=ma23578&mrk=239876506
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:42 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
container.html
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FE12 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Wed, 19 Jun 2024 19:44:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
/
cds.taboola.com/ 		0
82 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cds.taboola.com/?uid=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726&uad=7909ac26c94c9592b7f3d0ce6d28b3921556d78b8bf9c72e91c35f410333685b&mbl=ZmFsc2U=
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
no-store
server
nginx
container.html
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5ED9 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
2
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Wed, 19 Jun 2024 19:44:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
qzf6dxi5wc8fiu0hxffwm.json
sopalk.com/c/ Frame B7E7 		1 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/c/qzf6dxi5wc8fiu0hxffwm.json?cb=1687290282392
Requested by
Host: sopalk.com
URL: https://sopalk.com/t.js?i=qzf6dxi5wc8fiu0hxffwm&cb=1897461687290282110
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-67.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e561b7eb91282aba0090eb6b74465305f2dbfd9c5ff885d344ec2721fe6f978f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
3Iuzq4_MkubxXamFySNQopDhCIqJt6_4
date
Tue, 20 Jun 2023 11:00:58 GMT
via
1.1 6a2d00c5c73022efc4bc2786f44b3cdc.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-P1
age
31443
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
1298
last-modified
Tue, 20 Dec 2022 11:07:27 GMT
server
AmazonS3
etag
"e55d9f069a60da5619fc41a69ff8d5d7"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
accept-ranges
bytes
x-amz-cf-id
cb6GdpX4Ljpaokxy7uHYsVXVfymlV7qU7jZETM4GrpKWlF923ono0g==
8448
s-jsonp.moatads.com/ocr/NATIVOINVCONTENT1/level3/ 		0
272 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s-jsonp.moatads.com/ocr/NATIVOINVCONTENT1/level3/8448?t=2023520198
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.54.69.151 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-69-151.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
null
date
Tue, 20 Jun 2023 19:44:42 GMT
last-modified
Tue, 18 Nov 2014 20:18:12 GMT
server
AmazonS3
x-amz-request-id
DCD0270FB4531B86
etag
"d41d8cd98f00b204e9800998ecf8427e"
content-type
application/x-javascript
cache-control
max-age=562
accept-ranges
bytes
content-length
0
x-amz-id-2
pIyu0R4qDeJYsKHrTRMlsslHF6T+nG28xuXKKJLCGZjrTsj4VYMeRqEE9Bw65gj+vlES+gMC9Qg=
async_usersync
ib.adnxs.com/ Frame D0F0 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=1922&pub_id=2234281&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=1922&pub_id=2234281
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
AN-X-Request-Uuid
8cb443e7-ea99-4745-8047-3d2ed97cf685
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ 		254 B
647 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
date
Tue, 20 Jun 2023 19:44:42 GMT
via
1.1 varnish
x-amz-request-id
JFXX7NJ7M2FJYZ6M
age
11524
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
VNuE79zGkuG1WkYkook/LzjO6m8khshs44k88xUnWQ3oapFOdrvCIvii4035AZYl3g9EnhgUwco=
x-served-by
cache-yul12823-YUL
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1687290282.490352,VS0,VE0
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
content-type
image/png
abp
94
access-control-allow-origin
*
cache-control
private,max-age=31536000
accept-ranges
bytes
x-cache-hits
7316
log
protected-by.clarium.io/ Frame FE12 		0
0
log
protected-by.clarium.io/ Frame FE12 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.107.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-107-2.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame FE12 		0
0
log
protected-by.clarium.io/ Frame 5ED9 		0
0
log
protected-by.clarium.io/ Frame 5ED9 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.107.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-107-2.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 5ED9 		0
0
vevent
nym1-ib.adnxs.com/ Frame B7E7 		0
959 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&e=wqT_3QKzCqAzBQAAAwDWAAUBCKmDyKQGEOeH1fvkv9n2YRjW9ZOJwbziiy4qNgkAAAECCOg_EQEHNAAA6D8ZAAAAgOtR6D8hERIAKREJADERG7Aw8LDBDTiCD0CCD0gCUK74hL4BWIaMowFgAGi488YBePn7BYABAYoBA1VTRJIFBvReAZgBrAKgAfoBqAEBsAEAuAECwAEEyAEC0AEA2AEA4AEA8AEAigIqdWYoJ2EnLCAyMTk3MjU4LCAwKTt1ZigncicsIDM5ODUzOTgyMiwgMCk7kgLxAyF3azZ1TEFpbm9JSWFFSzc0aEw0QkdBQWdob3lqQVRBQU9BQkFBMGlDRDFEd3NNRU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFhZ0JBN0FCQUxrQnZ0Qk14UUFBNkRfQkFiN1FUTVVBQU9nX3lRR1FMOEdURlpMX1A5a0JBQUFBQUFBQThEX2dBUUQxQVFBQUFBQ1lBZ0NnQWdDMUFnQUFBQUM5QWdBQUFBREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xPV1UweU9qWXhOekRnQS1sRGlBUUFrQVFBbUFRQndRUUFBQUFBQUFBQUFNa0VBQQkLHEFBRFlCQUR4FZUoQUFBaUFXYU1La0YBDAEBFDhELXhCUQEKCQEId1FVCQkBAQBNGSgMQUFEUi4oAAAyLigAuE9BRi1Na0U4QVhtZ2FzSi1BV0tqb1lCZ2dZRFZWTkVpQVlBa0FZQm1BWUFvUVlBAVs4QUFEb1A2Z0dBYklHSkFrCRMBAQRCRQEGCQEEQmsJCAEBAEMdGEhMZ0dLQS4umgKZASFraERaOVFpNvUBLElhTW93RWdBeWdBTRHdKE9nX09nbE9XVTB5KUkYQkE2VU5KQQ0BDDhEOVINCxBBQUFCWgEGCQEEQmgJCAEBBEJwAQYJAQRCeAkIAQEQQjRBSWsuaAH0NAEu2ALWCeACh5wK6gKCAWh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS8yMDIzLzA2LzIwL21lZ2hhbi1tYXJrbGUtZWFybmVkLW1vcmUtdGhhbi10aGUtd2Vla25kLWZvci1qdXN0LTEyLWhvdXJzLXdvcmstZXgtc3BvdGlmeS1leGVjLXRlbGxzLWJiYy-AAwCIAwGQAwCYAxmgAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjE5MjIjTllNMjo2MTcw2gQCCAHgBADwBK74hL4BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAACFWWjYBQHgBQHwBQH6BQQIABAAkAYAmAYAuAYAwQYFICwA8D_QBukG2gYWChAJERkBdBAAGADgBgHyBgIIAIAHAYgHAKAHAcgH-fsF0gcNCREoASYI2gcGAV1wGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=16ae8fbaae226d69085a8df4aab62884d2fcb8c6&type=nv&nvt=5&jm=1003&px=2337&py=874&bw=300&bh=250&sid=7079310331916757313&vd=ct~0|rr~0&sv=236&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=28334192&sw=1600&sh=1200&pw=4000&ph=10477&ww=1600&wh=1200&ft=2
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:42 GMT
AN-X-Request-Uuid
f9d24e18-de62-46a4-8759-c64412e7c8f3
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame B7E7 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssN4fRksKI_PN1UfbVAXFwnIIogJVEUD2BcbAAC6JsuLDMKvrecVf_4HibBxMG3fQZfGZbC70jmU5n0qjQ3YNsfwv7oza_rTOS58EgcRBFyp25g_V8VZSL2pQO16izqoaTnjVlmmLyeqLRKA996VcPLZwzfg-Q88DTFMU5tw27PXgdq9WPmviJFNeCIeUjSIEJ90Xm4varJMSN5o_9jGIYoxY4snv24wR_5L_OdV4LGWR3UKiXhwzZbMT5rKRQOe_IDIJhIAoTgZnl_uxkaCDbcTTRKqBRHrozzUfqWAKa28PosAfP1lN5LxFZWXbSKYz3Zjumm9XbXUILoQprhTHXqvfW1tGUhg1w9MC2aVv6m96b4HIkC0IxWPPQUUwgIS7TUADuA668&sai=AMfl-YSxqixesfJWfsEPOSqDk2-rL01JzMHabE126XHoK_GCO_TecM7l6rKyRJKk58WwQdpEcNW76sMuQ9f0R-6JletGuzynYSnAH1qeOLbQnKNEsczKYiDvNBOIktcPGA&sig=Cg0ArKJSzB4T4lZh7ZmYEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:42 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ Frame 9A8F 		77 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1a4e3ef2398b9b2cb81b94063098e308139fa0cc0635b8c26ee4fb303a28e21e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26343
x-xss-protection
0
server
cafe
etag
784 / 19528 / m202306140101 / config-hash: 16396063179614486054
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:42 GMT
prebid7.19.0.js
hb.adpone.com/ Frame 9A8F 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3459
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BNWNL79Ig%2FHJGSwIycAvSB4Y7bRncrfguN%2BWug2PIQcqcxVkJFxr7YnNTDks62wVTbHduUdaexlmwctOC8N1aI0EQFHimLzmsCR%2BoKKTgLEtPg42sPQLqasIL8Fn0IhaMIOongGDmoNbo5o%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6820ca93918cc-EWR
p.html
sopalk.com/r/ Frame B456 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=adcnnnssu&e=1918623590599
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-67.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45030
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 957a0e737a088bdc07cb5cc9dcc9e826.cloudfront.net (CloudFront)
x-amz-cf-id
9-xzAOYBHYUXEO1XlWyzXTTEXEowCo9iLOQsXO4fwbhftMY-79Wa_w==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 7C4E 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=cbyfcuv&e=1918623590599
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-67.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45030
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 957a0e737a088bdc07cb5cc9dcc9e826.cloudfront.net (CloudFront)
x-amz-cf-id
w1Rwbl7mo98eUSiM4Nev1DrJnWLhj64Ju-_8LgXhpfyilN1DTsxfog==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 1974 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=bdaakmyj&e=1918623590599
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-67.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45030
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 957a0e737a088bdc07cb5cc9dcc9e826.cloudfront.net (CloudFront)
x-amz-cf-id
rovTrJhD9CRSdkkZA051IOB1BOKrFfDeWQ-hIdxzGd5fSzBxAkXwRQ==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame E61A 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=vciuxsaem&e=1918623590599
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-67.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45030
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 957a0e737a088bdc07cb5cc9dcc9e826.cloudfront.net (CloudFront)
x-amz-cf-id
MxSsPIDjOCqXGBt6gdX5Ux2KJqw2Kq8nTdxzja8bxY0r1PBP9MUI1w==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 9134 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=tnhfdisl&e=1918623590599
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-67.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45030
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 957a0e737a088bdc07cb5cc9dcc9e826.cloudfront.net (CloudFront)
x-amz-cf-id
NwTPbGgSSU-Gyqb6qIwt1dviu4pAxRFNpXFKkTdYAuYPDIYuNMXjjQ==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame BA75 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=pexbbykyq&e=1918623590599
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-67.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45030
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 957a0e737a088bdc07cb5cc9dcc9e826.cloudfront.net (CloudFront)
x-amz-cf-id
Wd7sTc7E2e1hz1H3Ecz61hsP9v14U9ZHB6xD8s1yXmrGHzbI_LKs_Q==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
p.html
sopalk.com/r/ Frame 8B0C 		10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sopalk.com/r/p.html?f=bkbch&e=1918623590599
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-67.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
45030
content-encoding
gzip
content-type
text/html
date
Tue, 20 Jun 2023 07:14:34 GMT
etag
W/"1d799671c4d6a9304651b1b9d6a783fb"
last-modified
Tue, 25 Oct 2022 13:58:03 GMT
server
AmazonS3
vary
Accept-Encoding Origin
via
1.1 957a0e737a088bdc07cb5cc9dcc9e826.cloudfront.net (CloudFront)
x-amz-cf-id
g157GvmosZeQ8NciDNNjrSBWs8p9oRqew5L4Tlbqwk0Wt1Gm7hZnyQ==
x-amz-cf-pop
EWR53-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
6P847P_3pwRq3kg1dbhEI8vZo9rD1MSu
x-cache
Hit from cloudfront
SPug
image4.pubmatic.com/AdServer/
Redirect Chain
  • https://image8.pubmatic.com/AdServer/ImgSync?p=162935&us_privacy=1---
  • https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=479CC621-B2E0-490D-8915-42055EBBC0EB&redir=true&gdpr=-1&gdpr_consent=
  • https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-36LK.RJE2uULfI0lRI4Z5o8v1zE.4FE-~A
0
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-36LK.RJE2uULfI0lRI4Z5o8v1zE.4FE-~A
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
162.248.18.34 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-36LK.RJE2uULfI0lRI4Z5o8v1zE.4FE-~A
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
sync
ads.yieldmo.com/v000/
Redirect Chain
  • https://ads.yieldmo.com/pbcas?us_privacy=1---&gdpr=0&gdpr_consent=&type=image
  • https://cm.g.doubleclick.net/pixel?google_nid=yieldmo_dbm&google_cm&pn_id=c
  • https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESECsNeKOUbQi_4bsJ6b7Oud8&google_cver=1
43 B
918 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESECsNeKOUbQi_4bsJ6b7Oud8&google_cver=1
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
3.218.133.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-218-133-69.compute-1.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
accept-ch
Sec-CH-UA,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Model,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile
access-control-allow-methods
POST, GET, OPTIONS
content-type
image/gif;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Cache-Control, Pragma, *
content-length
43

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ads.yieldmo.com/v000/sync?pn_id=c&google_gid=CAESECsNeKOUbQi_4bsJ6b7Oud8&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
299
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
CookieIndex
rtb.adentifi.com/
Redirect Chain
  • https://dsum.casalemedia.com/pbusermatch?origin=prebid&site_id=945271&p=1&i=0&gdpr=0&gdpr_consent=&us_privacy=1---
  • https://rtb.adentifi.com/CookieIndex
0
35 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.adentifi.com/CookieIndex
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
34.206.101.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-101-164.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:43 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://rtb.adentifi.com/CookieIndex
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
0
Expires
0
xuid
eb2.3lift.com/
Redirect Chain
  • https://eb2.3lift.com/sync?px=1&src=prebid&us_privacy=1---&
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=3658&xuid=db51a350-c421-4780-94b8-db6155d007ec&dongle=0cfd&gdpr=0&gdpr_consent=
37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=3658&xuid=db51a350-c421-4780-94b8-db6155d007ec&dongle=0cfd&gdpr=0&gdpr_consent=
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Server
35.71.139.29 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
afb83dd09526a6517.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
date
Tue, 20 Jun 2023 19:44:43 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://eb2.3lift.com/xuid?mid=3658&xuid=db51a350-c421-4780-94b8-db6155d007ec&dongle=0cfd&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
251
index.js
cdn.pranmcpkx.com/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pranmcpkx.com/index.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/7991) /
Resource Hash
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 20 Jun 2023 19:44:43 GMT
content-encoding
gzip
content-md5
nynBpfvYghYqzIzsvfssRw==
age
206505
x-cache
HIT
content-length
2382
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jun 2022 17:08:13 GMT
server
ECAcc (nya/7991)
etag
0x8DA5083F65AD9E0
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
x-ms-request-id
771178af-101e-005f-22ce-a14382000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
x-ms-version
2009-09-19
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2291221096554844&correlator=3632522048389336&eid=31075065%2C31075399%2C31075487&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=8&adks=1140109686&didk=1622125026&sfv=1-0-40&ris=1&rcs=2&prev_scp=pos%3DSponsorship_1%26confiant_refresh%3Dtrue%26htl_refresh%3D2&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D236787765623%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D2a155da8dea23fa8%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_MZag-KaHfPvInqD3jUyqai_PEpSaw&gpic=UID%3D00000c52bd207673%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_Ma5lMtSzeU4G6-9L7c_E3E1qQ58Kg&abxe=1&dt=1687290283091&lmt=1687290283&dlt=1687290276662&idt=1385&adxs=3075&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=320x50&msz=320x50&fws=3076&ohw=1254&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvj90cD2IStBPePV2sU5XIZEsMBGkm5YuxQS6jiD838Iv3JaJi0pJmR-WBBxBdM_tb-RL2AkYWZf6FZVZvXTlxDnrsCfKOgg&ga_vid=461448689.1687290279&ga_sid=1687290280&ga_hid=1059800600&ga_fc=true&a3p=EhkKCnVpZGFwaS5jb20Y7OHZ0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjg6dnSjTFIAFICCGoSGQoKcHViY2lkLm9yZxje5dnSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y7OHZ0o0xSABSAghk
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9fb6084a36818c42b3de0291310504e999f18b00fbd3628613c1380c63f7e05d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13263
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/ Frame 9A8F 		408 KB
126 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5b70d8eb19ca32d244e29e759e816c343be893232978532c9d5943f838e60e0b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 06:48:24 GMT
content-encoding
br
x-content-type-options
nosniff
age
46579
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
129045
x-xss-protection
0
server
cafe
etag
16806126990728334555
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Wed, 19 Jun 2024 06:48:24 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ Frame 9A8F 		616 B
320 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.mercurynews.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ac888a811086e5e08352c3dc0d0b704206641c37f78b1932c3ca956367aed497
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:43 GMT
openrtb
adx.adform.net/adx/ Frame 9A8F 		0
627 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 9A8F 		0
0
/
prebid.smilewanted.com/ Frame 9A8F 		0
312 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da6820edaea6372-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
translator
hbopenbid.pubmatic.com/ Frame 9A8F 		0
63 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:43 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cdb
bidder.criteo.com/ Frame 9A8F 		0
197 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=50971174074&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://www.mercurynews.com
date
Tue, 20 Jun 2023 19:44:42 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
prebid
ib.adnxs.com/ut/v3/ Frame 9A8F 		13 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
b73e577f4d3cebf04fd7a68c6f8f087a41ebd9414f550b6020ba539473e5893d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:43 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
4f2c12d9-4f5e-4515-852f-830bdd6f2229
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://www.mercurynews.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
prg.smartadserver.com/prebid/ Frame 9A8F 		813 B
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.1 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
216.22.16.1.servint.net
Software
/
Resource Hash
196a17c1b8e4d675d0d5d6be75febe01dcb43f66529e9054d843591a50459bf2

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
prebid7.19.0.js
hb.adpone.com/ Frame B456 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=adcnnnssu&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3460
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZkEGpCDgSc0tznfJX7NZKBr%2FURbyWqjj1MBlIbifNK13Ufc5oXR4EP6M%2BIdIyhLbiiqrXuq4yVptuXNgvbVeJIy%2FVbU3Adnx7yTY5vPr5gc1ZQ%2FjnLpkzle5h36wqa0T0XUy%2FbfELnu7NPM%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6820e4b2518cc-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 7C4E 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=cbyfcuv&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3460
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m5yVBd43tD%2B6LpgPz9SkNPCqDVqj0ZgmmqR0Jl79xAd1Vv5zFkgcwDdwLy5uun0Gw%2F4Ylz0eBVt%2FdsYVYVW7CJnueGpwHek2M9CO2iZb%2B2GDWtJ4W5BjHbxQ3LpJK%2B66g8XEMUxecwz9bik%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6820e5b2e18cc-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 1974 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=bdaakmyj&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3460
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FfpN9xlYIdJ2cXzgkx7wYuc85YS57ZURMgpuDYOeg92nE8%2BLeJ5ZGWiVs0nd3Vdv87VxGtBa87RyeSmz%2FWATe0h9IHK45bbVOIv7e3Uj%2BcQn9PBxoWBGCtuG3eXFlPGruFYKocSAW6agX1A%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6820e5b3218cc-EWR
prebid7.19.0.js
hb.adpone.com/ Frame E61A 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=vciuxsaem&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3460
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l0Z%2BBXnDf2Ve4JekVV4SIOSBOLzH8JMdV%2BJskP6MTiAQ1xRpxkb9JRj4u1CMTkFsCxoSmOhQdzWEGDkS5cFzyW19A2xJWgbSMrmRQJU8ttU3BP0k%2FcANrUDBaD%2Ft8hakRIcs7TBPETxvGxk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6820e5b3718cc-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 9134 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tnhfdisl&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3460
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UtYYS4WoaZiHoYZZTIsbNTK4QimM7PHxjbqlDGspsIHtFcFGoonW2x8%2BW3HibfYN1I2KCkjftIjbcsUJwMlMM2SaDopHh%2FilM7GXKU4Sf%2FDEEvqPEFiUrALorRlhMKURHczz%2B%2BXQCaAOTXE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6820e6b3a18cc-EWR
prebid7.19.0.js
hb.adpone.com/ Frame BA75 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=pexbbykyq&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3460
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b%2B6nb1t0pY9NCnhHPqWCG%2BvmxLEjPenZ6IAa3mTyzIATsPLNKxfiOHH4HZLcRXrthGywjpqN0ho%2BuWpnCL%2F2Ui5wIxiaVrzqdbWKyLnpVF8WD9DKfsedoGyyTaV4LG9KSggnpy5IYeGfEss%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6820e6b4018cc-EWR
prebid7.19.0.js
hb.adpone.com/ Frame 8B0C 		424 KB
122 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://hb.adpone.com/prebid7.19.0.js
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=bkbch&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
x-amz-version-id
mrzpmMNa6L0T_nTXd2e.MsW_mFVsXsAR
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
V8WJGSKY7R2G1FAQ
age
3460
x-amz-server-side-encryption
AES256
x-amz-id-2
AP2+ET5zcC45xWk8LudxpTuSnzMo9QRQxBhyXQlHmVWiaCKPaepjFS43GlVxruZbqwhkJ3GPriQ=
last-modified
Tue, 25 Oct 2022 11:05:38 GMT
server
cloudflare
etag
W/"c5676242a8c3f69dca478f87ab473b3a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1YbKw0nZRBj2yaEAJSiA%2F%2BjkSn8YfWx%2Bay8BF7MduJQSVkBr%2FzEKmIgkNOLocpNnFHTYyr462z0KmH4xB9s6NeIi0JnkcJ1zRCS2XavnlQV%2B2jiasfse%2FsuQw%2B33QRemIRIr7ebBygUO7TQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7da6820e7b4618cc-EWR
container.html
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 54C3 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
3
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Wed, 19 Jun 2024 19:44:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
cdb
bidder.criteo.com/ Frame B456 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=34556979577&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame B456 		0
0
openrtb
adx.adform.net/adx/ Frame B456 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
translator
hbopenbid.pubmatic.com/ Frame B456 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ Frame B456 		145 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
42cda85ec144d11030fa9e1516a35645dbb153580ba01934f9c24b659cfeb841
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:43 GMT
AN-X-Request-Uuid
ab6ef92d-49d7-4f50-8ce8-3ea74bf9657c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
145
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
prg.smartadserver.com/prebid/ Frame B456 		1019 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.1 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
216.22.16.1.servint.net
Software
/
Resource Hash
38918e8452a9b201d47041349b1e7636d806873297665f71eb3964142cbeb4d9

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame B456 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da682100c156372-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
translator
hbopenbid.pubmatic.com/ Frame 7C4E 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
/
prebid.smilewanted.com/ Frame 7C4E 		0
50 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da682101c186372-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
openrtb
adx.adform.net/adx/ Frame 7C4E 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
prebid
ib.adnxs.com/ut/v3/ Frame 7C4E 		15 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
a4eab6932f42334172b3a48e3c86969f36b63c44420755aa83197c927f439a4e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:43 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
d2507307-c8fd-4c92-8565-11310e83cfac
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 7C4E 		0
0
v1
prg.smartadserver.com/prebid/ Frame 7C4E 		989 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.1 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
216.22.16.1.servint.net
Software
/
Resource Hash
47e8953eb8bca1d9b667405d1a6bee9cfc01c334394188d0ac4eabd41ec41b93

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
cdb
bidder.criteo.com/ Frame 7C4E 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=20201653379&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
log
protected-by.clarium.io/ Frame 54C3 		0
0
log
protected-by.clarium.io/ Frame 54C3 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.107.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-107-2.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 54C3 		0
0
event-stream
k.p-n.io/ 		0
126 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://k.p-n.io/event-stream
Requested by
Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.64.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-64-172.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:43 GMT
access-control-allow-headers
*
access-control-max-age
600
access-control-allow-methods
*
v1
prg.smartadserver.com/prebid/ Frame E61A 		845 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.1 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
216.22.16.1.servint.net
Software
/
Resource Hash
e1e394d3e5f917849f224f27fc2a9d52ba89d199b8b3fd3010e8485e1bc42c84

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/ Frame E61A 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:43 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
openrtb
adx.adform.net/adx/ Frame E61A 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
/
prebid.smilewanted.com/ Frame E61A 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da682112d186372-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
cdb
bidder.criteo.com/ Frame E61A 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=60696704250&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:42 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame E61A 		0
0
prebid
ib.adnxs.com/ut/v3/ Frame E61A 		13 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
9652a04e786af562fe276abb568aae827014a1773877100e08eaa305b6ce2e85
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:43 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
25ac205b-835b-4d2e-ab0a-95badbfda291
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cdb
bidder.criteo.com/ Frame 9134 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=81164777002&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
prebid
ib.adnxs.com/ut/v3/ Frame 9134 		13 KB
7 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
81f35b682d284eb5c01472a7123abc7b6f57cf0b5a7dcd216b944ceab3ed72d9
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:43 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
e5d5a916-584d-496c-b04f-122850a0459d
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
prg.smartadserver.com/prebid/ Frame 9134 		971 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.1 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
216.22.16.1.servint.net
Software
/
Resource Hash
278eedcc7c647c92881450517e7880aebceaccfa25b75843a9f17d68fbdc65be

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
translator
hbopenbid.pubmatic.com/ Frame 9134 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:43 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
openrtb
adx.adform.net/adx/ Frame 9134 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 9134 		0
0
/
prebid.smilewanted.com/ Frame 9134 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da682113d2b6372-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
/
prebid.smilewanted.com/ Frame 1974 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da682116d476372-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
translator
hbopenbid.pubmatic.com/ Frame 1974 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:42 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 1974 		0
0
v1
prg.smartadserver.com/prebid/ Frame 1974 		927 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.1 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
216.22.16.1.servint.net
Software
/
Resource Hash
88ec57b8417623a1f1e155f0db4c5a08faf82b19e18cfb8fb27dc17100744360

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:42 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ Frame 1974 		15 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
c07125e852d86e5155db6183d60cf7a4575788766760d5383a70576e1e81535a
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:43 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
c4c5895a-c1e3-4d24-a11f-844b05357993
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
openrtb
adx.adform.net/adx/ Frame 1974 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
cdb
bidder.criteo.com/ Frame 1974 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=46512213418&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
translator
hbopenbid.pubmatic.com/ Frame BA75 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:43 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame BA75 		346 B
418 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283252&tk_flint=pbjs_lite_v7.19.0&x_source.tid=244a029f-169a-4cbf-85bf-b9292725f5ea&l_pb_bid_id=4d71e2122ba2c1&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7347246849519282
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
e17fd2e42b4161652b49ae5e51e37a991e1ec6a10fb893097868bc3e59863bea

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:44 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
/
prebid.smilewanted.com/ Frame BA75 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da682117d5b6372-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
openrtb
adx.adform.net/adx/ Frame BA75 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
cdb
bidder.criteo.com/ Frame BA75 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=99183198578&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:42 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
prebid
ib.adnxs.com/ut/v3/ Frame BA75 		144 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e84418fa9bb7dc9b980511c38088001ebe424a68752b43dafb8812839bd95015
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:43 GMT
AN-X-Request-Uuid
c6f11dd6-fd72-4a2b-b086-84faf29dd6a1
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
144
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
v1
prg.smartadserver.com/prebid/ Frame BA75 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.1 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
216.22.16.1.servint.net
Software
/
Resource Hash
0b0738ca18af8998645608545bac36ebfbbc8719021e6c46c0ed46de1306a66c

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
fastlane.json
fastlane.rubiconproject.com/a/api/ Frame 8B0C 		346 B
381 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283259&tk_flint=pbjs_lite_v7.19.0&x_source.tid=411f8e2e-bf90-485b-a7ec-cae4171239dc&l_pb_bid_id=25cb5df8388fcf&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.543300309238284
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2602:803:c002:200::42 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
nginx/1.21.4 /
Resource Hash
28519471dca273ae1ae4e71f7312ed85780fb03588532aab4845a6cf41740043

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:44 GMT
server
nginx/1.21.4
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://sopalk.com
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
content-length
346
expires
Wed, 17 Sep 1975 21:32:10 GMT
/
prebid.smilewanted.com/ Frame 8B0C 		0
36 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://prebid.smilewanted.com/
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

date
Tue, 20 Jun 2023 19:44:43 GMT
cf-cache-status
DYNAMIC
server
cloudflare
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, private
access-control-allow-credentials
true
cf-ray
7da682118d616372-ORD
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
openrtb
adx.adform.net/adx/ Frame 8B0C 		0
619 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://adx.adform.net/adx/openrtb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.6.233 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
p3p
CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin
https://sopalk.com
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires
-1
translator
hbopenbid.pubmatic.com/ Frame 8B0C 		0
56 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.36.115.111 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:43 GMT
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cdb
bidder.criteo.com/ Frame 8B0C 		0
188 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bidder.criteo.com/cdb?profileId=207&av=34&wv=7.19.0&cb=41511890676&lsavail=0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

access-control-allow-origin
https://sopalk.com
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; preload;
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
server
Kestrel
vary
Origin
v1
prg.smartadserver.com/prebid/ Frame 8B0C 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://prg.smartadserver.com/prebid/v1
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.22.16.1 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
216.22.16.1.servint.net
Software
/
Resource Hash
e8d943c317239426e4c43d126168a3a67237de9ac0f3a97ef73afec6e5346ad0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
content-encoding
br
transfer-encoding
chunked
vary
Accept-Encoding, Origin
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://sopalk.com
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
no-cache,no-store
access-control-allow-credentials
true
prebid
ib.adnxs.com/ut/v3/ Frame 8B0C 		15 KB
8 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
3d5b8643f364025e855cd7f47749a9cea23d3fba8ccdc1ee252d7a8fee9fed6d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain

Response headers

Date
Tue, 20 Jun 2023 19:44:43 GMT
Content-Encoding
gzip
Transfer-Encoding
chunked
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
bf9ac405-db1b-4233-b881-b1747fef5427
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
event-stream
k.p-n.io/ 		0
125 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://k.p-n.io/event-stream
Requested by
Host: cdn.p-n.io
URL: https://cdn.p-n.io/pushly-sdk.min.js?domain_key=kxKkF9MK5Eh8oIGD7DDm6lvkHUj6DuIrCOQh&ver=6.2.2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.84.64.172 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-64-172.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:43 GMT
access-control-allow-headers
*
access-control-max-age
600
access-control-allow-methods
*
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		35 KB
14 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2291221096554844&correlator=4075127704762969&eid=31075065%2C31075399%2C31075487&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Ctop_leaderboard&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=9&adks=142133714&didk=303353385&sfv=1-0-40&ris=2&rcs=2&prev_scp=pos%3Dtop_leaderboard%26confiant_refresh%3Dtrue%26htl_refresh%3D2&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D236787765623%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D2a155da8dea23fa8%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_MZag-KaHfPvInqD3jUyqai_PEpSaw&gpic=UID%3D00000c52bd207673%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_Ma5lMtSzeU4G6-9L7c_E3E1qQ58Kg&abxe=1&dt=1687290284169&lmt=1687290284&dlt=1687290276662&idt=1385&adxs=1636&adys=323&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=728x90&msz=728x90&fws=3076&ohw=1280&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvj90cD2IStBPePV2sU5XIZEsMBGkm5YuxQS6jiD838Iv3JaJi0pJmR-WBBxBdM_tb-RL2AkYWZf6FZVZvXTlxDnrsCfKOgg&ga_vid=461448689.1687290279&ga_sid=1687290280&ga_hid=1059800600&ga_fc=true&a3p=EhkKCnVpZGFwaS5jb20Y7OHZ0o0xSABSAghkEhsKDGlkNS1zeW5jLmNvbRjg6dnSjTFIAFICCGoSGQoKcHViY2lkLm9yZxje5dnSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y7OHZ0o0xSABSAghk
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
82f60fb22b09313b4ab16333f0d427614b8adb5c74285e988e023aae8d795673
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14637
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame 738D 		0
260 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156011&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156011&s=165626&predirect=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Dpubmatic.com%26id%3DPM_UID&gdpr=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
dcmads.js
www.googletagservices.com/dcm/ Frame 88E1 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:58:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2796
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:58:08 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame 88E1 		80 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:44 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27646
Expires
Wed, 19 Jun 2024 19:44:44 GMT
it
nym1-ib.adnxs.com/ Frame 88E1 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQirg8ikBhDWx4O9xdCKk30Y1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXicpQSAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFzSjFIcWdqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMU5UTXk0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGbkN1UUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhMTGdHQ2cuLpoCxQEhSHlOX193amcy_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qVTFNekpBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjU1MzLaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo2MTk3uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABSnhUMVZGb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpMU1IRUFBQUFBQUFBQUFIZ0FnUUVBQUFBKd0ASa0fMEpvQkFnZ0FxQUVBc1Fdj3xBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHnKUE0gcNCS63AIzaBwYIABAAGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=8fc2da3f437f964491d0b5f56e37b58b4f16632d
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:44 GMT
AN-X-Request-Uuid
1d3999e7-58be-4fbf-95d2-109540f43294
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
614620065398091
connect.facebook.net/signals/config/ 		300 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/614620065398091?v=2.9.107&r=stable
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4424132c76bd3b942b9a4b0dc628dc4cd5826b75022aca28ad4ae6a696f35437
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:44:44 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
87969
x-xss-protection
0
pragma
public
x-fb-debug
9ZCVG+BcE3ugXDWbuDk1R7waE8Hsx+nezUK4pEyjyifrYMB0rDVHQMH5bzSVRA3JunvhpskZgq9PsVGHQTuw5A==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
js
www.googletagmanager.com/gtag/ 		188 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-747356055
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2008 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
af6aafd437d899bea1c7a01d77830ee97f3e7f30f9e3be515ed8b47df98a6097
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
69736
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 20 Jun 2023 19:44:44 GMT
bat.js
bat.bing.com/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 20 Jun 2023 19:44:43 GMT
last-modified
Thu, 11 May 2023 18:08:27 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: A9DDA1DD15B9471C9208F7501F8DEBE8 Ref B: YMQ01EDGE0522 Ref C: 2023-06-20T19:44:44Z
etag
"80df77953384d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12183
swap.js
cdn.callrail.com/companies/649313642/d272108827995ed1b1b1/12/ 		36 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.callrail.com/companies/649313642/d272108827995ed1b1b1/12/swap.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-107.ewr53.r.cloudfront.net
Software
/
Resource Hash
a54690656b18f041c597eb704cbc6ee95c571db2ed7460392e7c49b899dcc74f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
via
1.1 11140291d542e546b40770525cf1e1b4.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-amz-cf-pop
EWR53-P1
x-cache
Miss from cloudfront
x-xss-protection
1; mode=block
x-request-id
6ade9d61-66b5-4a32-8560-f358d7c7c34b
x-runtime
0.010462
referrer-policy
strict-origin-when-cross-origin
etag
W/"a54690656b18f041c597eb704cbc6ee9"
x-download-options
noopen
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600, public
timing-allow-origin
*
x-amz-cf-id
w5klu8H1AAGwn-cY0JKPymMISNQHkr4zMoc_nAqhsaOMisQ4YX5jZg==
usermatch.gif
beacon.krxd.net/
Redirect Chain
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:6swk5ma&fmt=3
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
0
337 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
Protocol
H2
Server
3.234.237.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-234-237-251.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
beacon-n036-ash-prod.krxd.net
date
Tue, 20 Jun 2023 19:44:44 GMT
cache-control
private, no-cache, no-store
x-request-time
D=39 t=1687290284
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
date
Tue, 20 Jun 2023 19:44:44 GMT
x-cache-hits
0
x-age
0
content-length
0
x-cache
MISS
x-served-by
usermatch-a003-ash-prod.krxd.net
generic
match.adsrvr.org/track/cmf/
Redirect Chain
  • https://insight.adsrvr.org/track/evnt/?adv=64gxdrp&ct=0:z2z62d3&fmt=3
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
  • https://tags.bluekai.com/site/5386?id=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ZGI1MWEzNTAtYzQyMS00NzgwLTk0YjgtZGI2MTU1ZDAwN2Vj&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db615...
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec&google_gid=CAESEGF0PBlV1wdoSEgoAmp5hzY&google_cver=1
  • https://ups.analytics.yahoo.com/ups/55953/sync?uid=db51a350-c421-4780-94b8-db6155d007ec&_origin=1&redir=true&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-G2eQr7xE2uLLtZa3EDZBKIx2lfSJnbM-~A&gdpr=0
70 B
750 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-G2eQr7xE2uLLtZa3EDZBKIx2lfSJnbM-~A&gdpr=0
Protocol
H2
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:45 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

location
https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-G2eQr7xE2uLLtZa3EDZBKIx2lfSJnbM-~A&gdpr=0
date
Tue, 20 Jun 2023 19:44:45 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
content-length
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
usermatch.gif
beacon.krxd.net/
Redirect Chain
  • https://insight.adsrvr.org/track/pxl/?adv=64gxdrp&ct=0:1ingnzv&fmt=3
  • https://usermatch.krxd.net/um/v2?partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
0
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
Protocol
H2
Server
3.234.237.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-234-237-251.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-served-by
beacon-n003-ash-prod.krxd.net
date
Tue, 20 Jun 2023 19:44:44 GMT
cache-control
private, no-cache, no-store
x-request-time
D=44 t=1687290284
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=ttd&partner_uid=ttd&gdpr=0&gdpr_consent=&ttd_tdid=db51a350-c421-4780-94b8-db6155d007ec
date
Tue, 20 Jun 2023 19:44:44 GMT
x-cache-hits
0
x-age
0
content-length
0
x-cache
MISS
x-served-by
usermatch-a021-ash-prod.krxd.net
sodar
pagead2.googlesyndication.com/getconfig/ 		14 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306140101&st=env
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d9129325eb3414d57b26fab773f2bf928c670dfc81ed80e066f85e12fbb26d14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11173
x-xss-protection
0
syncframe
gum.criteo.com/ Frame 8197 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:43 GMT
server
Kestrel
server-processing-duration-in-ticks
572556
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
track
dc.services.visualstudio.com/v2/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.42.73.140 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,sdk-context
Access-Control-Request-Method
POST
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Sdk-Context
access-control-allow-methods
POST
access-control-allow-origin
*
access-control-max-age
3600
content-length
0
date
Tue, 20 Jun 2023 19:44:44 GMT
x-content-type-options
nosniff
track
dc.services.visualstudio.com/v2/ 		96 B
281 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dc.services.visualstudio.com/v2/track
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.42.73.140 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
7e0e8aa8b79a82ed3333ae5ad64bb6ca9c0ab19ecf23bc04e921c26be1f9a9a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
Sdk-Context
appId
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-type
application/json

Response headers

x-ms-session-id
C7F3C972-B006-4CC4-9D96-0266BE03483B
strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:44 GMT
x-content-type-options
nosniff
access-control-max-age
3600
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
Origin, X-Requested-With, Content-Name, Content-Type, Accept, Cache-Control, Sdk-Context
content-length
96
vitals
www.foo.software/api/ 		0
95 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.foo.software/api/vitals
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
137.184.240.117 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.25.0 / Express
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
*
date
Tue, 20 Jun 2023 19:44:44 GMT
server
nginx/1.25.0
x-powered-by
Express
8445ca4c-6671-42fb-a3e1-aac609e1c135
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/8445ca4c-6671-42fb-a3e1-aac609e1c135
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
impl_v96.js
www.googletagservices.com/dcm/ Frame 88E1 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:58:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42397
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 07:58:07 GMT
bb5a5b1a-49f2-4360-b95c-440e6b3864a8
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/bb5a5b1a-49f2-4360-b95c-440e6b3864a8
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
375497417216748
connect.facebook.net/signals/config/ 		376 KB
107 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/375497417216748?v=2.9.107&r=stable
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
51b9c4f1aa6c3e60906e6dad687a22e11aa9f5e517d748eafcba598b1a683b30
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 20 Jun 2023 19:44:44 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
109843
x-xss-protection
0
pragma
public
x-fb-debug
Rz2a7xCg6Cfs+OftHOGt66FwheippjofPfDe42FCyzthh6JRyk8utWcey/TdFZ+Z1UDUWNzN2pHxk2L47+AQ4g==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/ 		0
185 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1060502780777063&ev=PageView&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687290284406&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1687290284402.1346453395&cs_est=true&it=1687290279615&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:44:44 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.facebook.com/tr/ 		0
31 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=614620065398091&ev=PageView&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687290284410&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1687290284402.1346453395&it=1687290279615&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:44:44 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
collect
www.google-analytics.com/g/ 		0
17 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-LMTT1ZNHB1&gtm=45je36e0&_p=1059800600&cid=461448689.1687290279&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=2&sid=1687290278&sct=1&seg=0&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LMTT1ZNHB1&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.mercurynews.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:44 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
25052057.js
bat.bing.com/p/action/ 		0
118 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/25052057.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Tue, 20 Jun 2023 19:44:43 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 1F298812815F47EA986F7B920C7514BF Ref B: YMQ01EDGE0522 Ref C: 2023-06-20T19:44:44Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/ 		0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=25052057&Ver=2&mid=7940a795-886e-4777-badf-8fa32138c7e9&sid=e7e095b00fa211ee84e63d750ae8cfdb&vid=e7e0f6800fa211ee8bc295fcd7296e79&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&p=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&r=&lt=7790&evt=pageLoad&sv=1&rn=588404
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 20 Jun 2023 19:44:43 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 83CC102603E64E03AF2C75D9BD0C80CC Ref B: YMQ01EDGE0522 Ref C: 2023-06-20T19:44:44Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
sid
mug.criteo.com/ Frame 8197
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=fbDKml90amV0bXg2enFNMG9EVXhtTGp1MmhEOCUyQnRsdGQ5TWVFeGkxJTJGcGpI...
  • https://mug.criteo.com/sid?cpp=Or9Jl3xqSlYra1VxcnkrVmlMQmNhK2p0WDJML1hLNnJ6ZDRmMjQvNW9MZjhGS1gzVzZ4YUxqekNGZ2JMSGkyeGZJeXVpemI1NmZJeXRibk0xc0pkVHRvR1U2aDI5ZjJocUxtSUJiVEZaaDhwR0l4MEw1Ymlmdm5wQ2R2R2...
419 B
647 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=Or9Jl3xqSlYra1VxcnkrVmlMQmNhK2p0WDJML1hLNnJ6ZDRmMjQvNW9MZjhGS1gzVzZ4YUxqekNGZ2JMSGkyeGZJeXVpemI1NmZJeXRibk0xc0pkVHRvR1U2aDI5ZjJocUxtSUJiVEZaaDhwR0l4MEw1Ymlmdm5wQ2R2R2xEM25Ub0ViakJHODlBRFIvWnFXRHdBRUZaTjJhZTFOZUhxRUV4UDdCMlp0WnluSERFV0J1a3VwZXdBYVBTODZqaHY3bC9ISlk5ME1TNkthQlVFQnF2OGF1c3N1alpKeDM3b1c0NTU5eTl5MmlucmVoTVZFc3hOamJEUG95bVMvZmMxbXZ2NzZuZWdJY3d2Y3oxbU90b3pZd2VSWVpWTGszY3NqN0NJRFZXbkpxYW10U29RTT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
35738f48bead5920d9d6918ac2199c0b378b8777b81ddbdf4fcf379a523ee801
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:44 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1494607
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:43 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=Or9Jl3xqSlYra1VxcnkrVmlMQmNhK2p0WDJML1hLNnJ6ZDRmMjQvNW9MZjhGS1gzVzZ4YUxqekNGZ2JMSGkyeGZJeXVpemI1NmZJeXRibk0xc0pkVHRvR1U2aDI5ZjJocUxtSUJiVEZaaDhwR0l4MEw1Ymlmdm5wQ2R2R2xEM25Ub0ViakJHODlBRFIvWnFXRHdBRUZaTjJhZTFOZUhxRUV4UDdCMlp0WnluSERFV0J1a3VwZXdBYVBTODZqaHY3bC9ISlk5ME1TNkthQlVFQnF2OGF1c3N1alpKeDM3b1c0NTU5eTl5MmlucmVoTVZFc3hOamJEUG95bVMvZmMxbXZ2NzZuZWdJY3d2Y3oxbU90b3pZd2VSWVpWTGszY3NqN0NJRFZXbkpxYW10U29RTT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
494601
content-length
0
expires
0
B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=730607261;ord=fpd6a9;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P9bjoFeEKi...
ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/ Frame 88E1 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=730607261;ord=fpd6a9;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P9bjoFeEKiZ91vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAvydVAwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HyN__wjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU1MzJA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NTMy%2Fbn%3D70300%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=161;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
8f6f381af402557866992339db2b841971e190563a8a69a2c89d8949db511b49
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:44 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29702
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cs.js
sb.scorecardresearch.com/internal-c2/default/
Redirect Chain
  • https://sb.scorecardresearch.com/c2/6035443/cs.js
  • https://sb.scorecardresearch.com/internal-c2/default/cs.js
0
359 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/internal-c2/default/cs.js
Protocol
H2
Server
13.35.93.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-35-93-41.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:36:29 GMT
via
1.1 67d3f8867c3d6540e7495f9026c9c57a.cloudfront.net (CloudFront)
last-modified
Mon, 01 Mar 2021 20:42:20 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P8
age
496
x-amz-server-side-encryption
AES256
etag
"d41d8cd98f00b204e9800998ecf8427e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
0
x-amz-cf-id
I1fms-wt_Ha2u7G2bfKUD54AwCxSYWnaqyhwhF8w9fO0QphZSxg9kg==

Redirect headers

date
Tue, 20 Jun 2023 19:44:44 GMT
via
1.1 67d3f8867c3d6540e7495f9026c9c57a.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
JFK50-P8
x-cache
Miss from cloudfront
location
/internal-c2/default/cs.js
content-length
0
x-amz-cf-id
ev6RLSivb5X7LGRC67YLJbBuBZWrmfL6PZ05ERZ1SYeuBHoEVaTZQw==
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:44:44 GMT
10a6b365-6641-44d0-9256-321ff71eb454
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/10a6b365-6641-44d0-9256-321ff71eb454
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
container.html
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6668 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
4
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Wed, 19 Jun 2024 19:44:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
/
www.facebook.com/tr/ 		0
31 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=375497417216748&ev=PageView&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687290284652&sw=1600&sh=1200&v=2.9.107&r=stable&ec=0&o=30&fbp=fb.1.1687290284402.1346453395&cs_est=true&it=1687290279615&coo=false&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:44:44 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
www.facebook.com/tr/ 		0
31 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=375497417216748&ev=ViewContent&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&rl=&if=false&ts=1687290284656&sw=1600&sh=1200&v=2.9.107&r=stable&ec=1&o=30&fbp=fb.1.1687290284402.1346453395&it=1687290279615&coo=false&tm=1&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 20 Jun 2023 19:44:44 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/747356055/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/747356055/?random=1687290284478&cv=11&fst=1687290284478&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&hn=www.googleadservices.com&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&us_privacy=1---&auid=124969367.1687290278&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ccebd5a925c1061c439066a3c67e73e36e59c3066e5dfc6230c1f114ee4393ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:44 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1434
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
log
protected-by.clarium.io/ Frame 6668 		0
0
log
protected-by.clarium.io/ Frame 6668 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.107.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-107-2.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 6668 		0
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame C6CB 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
46573
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 06:48:31 GMT
expires
Wed, 19 Jun 2024 06:48:31 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 2F14 		783 B
535 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
025d3def2f9f980962e81f1bf2f4196df1aa87fb9acbfc1d2d5e21fd5c3c1206
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-CN4WBjWaaUrwhGi4TaQOaQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
513
content-security-policy
script-src 'report-sample' 'nonce-CN4WBjWaaUrwhGi4TaQOaQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:44 GMT
expires
Tue, 20 Jun 2023 19:44:44 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 88E1 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=730607261;ord=fpd6a9;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P9bjoFeEKiZ91vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAvydVAwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HyN__wjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU1MzJA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NTMy%2Fbn%3D70300%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=161;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:44 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame 88E1 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=730607261;ord=fpd6a9;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P9bjoFeEKiZ91vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAvydVAwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HyN__wjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU1MzJA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NTMy%2Fbn%3D70300%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=161;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
5692
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 88E1 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvz-WOhx4Jho-AhqrtUpvh6hwAz4D24dXxE74mUybmynW0RDXIsn8Nv3tYUBZyG9-ByNLwum9X3zeyI0arLSc7-QUOSkB3-KrvYtGvvBMcUL3j4W1utqj5U_uAhfZao_eWK9IcsiDkWxhLfaVmbq0vBB3yBTOc3hUz6UD3JsA4pM8I&sai=AMfl-YSUY_3nYEwFZy6k2EnfTBmfp9ZkNCLqCgsaKLo03YLYAyzGFDVs4M8NTmTNSqrZRJcBEB9FNKbY1P3se09GK-7qlGxnYvcxz514rA&sig=Cg0ArKJSzL4b1jbXdEmVEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=3&cbvp=1&cstd=1&cisv=r20230615.12364&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=730607261;ord=fpd6a9;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P9bjoFeEKiZ91vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAvydVAwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HyN__wjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU1MzJA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NTMy%2Fbn%3D70300%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=161;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:44 GMT
dvtp_src.js
cdn.doubleverify.com/ Frame 88E1 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=730607261;ord=fpd6a9;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P9bjoFeEKiZ91vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAvydVAwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HyN__wjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU1MzJA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NTMy%2Fbn%3D70300%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=161;prcl=s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:45 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 14:39:49 GMT
Server
UploadServer
ETag
"6bbda2156609c9b24e1e0e365f01b513"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3374
Expires
Sun, 18 Jun 2023 14:55:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 88E1 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=730607261;ord=fpd6a9;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P9bjoFeEKiZ91vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAvydVAwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HyN__wjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU1MzJA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NTMy%2Fbn%3D70300%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=161;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:59:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42317
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 07:59:27 GMT
17632058214988633165
s0.2mdn.net/simgad/ Frame 88E1 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/17632058214988633165
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=bkbch&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dead1f4e72e8cf849bdac46b95a197af4af11ed48877c2db53f38c3b7f43e545
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:42:29 GMT
x-content-type-options
nosniff
age
558135
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37712
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 19:19:13 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 08:42:29 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame 869D 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=bkbch&e=1918623590599
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46994
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:44 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291005
X-Served-By
cache-lga13626-LGA, cache-yul12833-YUL
X-Timer
S1687290285.896463,VS0,VE0
rd_log
nym1-ib.adnxs.com/ Frame 88E1 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKJEPBMCQgAAAMA1gAFAQirg8ikBhDWx4O9xdCKk30Y1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXicpQSAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFzSjFIcWdqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMU5UTXk0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGbkN1UUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhETGdHQ2cuLpoCxQEhSHlOX193Ov0CLExtcmx3RWdBQ2dBTQXBCQF8T2dsT1dVMHlPalUxTXpKQTZVTkpOank5VXBZaDlUOVIJJgEBBEJaAQYJATRCaEtWeVB3dlVvekQ5cAkUAQEEQngBBgkBYUlUSUJId2loeXlVUUJSZ0JJZ05EUVVRcBlgODh4UW1EbDBDTGJ5VC1KQRGY8F5QQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS_yAhEKBkFEVl9JRBIHNTUyMTA2OPICEgoGQ1BHX0lEEggyMTA4OTM2NvICEgoFQ1BfSUQSCZVGEPICDQoIAT4YRlJFURIBMAUQHFJFTV9VU0VSBRAADAkgGENPREUSAPIBDwhDUEcVDxALCgdDUBUOFBAKBUlPXwGJADiJ0ADyASEESU8VITgTCg9DVVNUT01fTU9ERUwBKxQA8gIaChYyFgAcTEVBRl9OQU0FcQgeCho2HQAIQVNUAT4QSUZJRUQBPhwVCghTUExJVAFNAAkV2fCwgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQPMTI5MTcjTllNMjo1NTMy2gQCCAHgBAHwBLyW180BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkABQzAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjYxOTe4BgDBBgk2LPA_0AaeqwLaBhYKEAkSGQFgEAAYAOAGAfIGhwEIwvZOEoABSnhUMVZGb0Gk4ERBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnQVFMQzB1Z2RJdjdXNkIxRHBRMWkxTUhFQQE9BQEMSGdBZ632BQEASc02LEpvQkFnZ0FxQUVBcy4gAHxBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHnKUE0gcNCRG5AbcI2gcGIQFwGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=a8da873b58706431aad5fcb139bfcd6ecd1795b4&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dbkbch%26e%3D1918623590599,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dbkbch%26e%3D1918623590599&
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=bkbch&e=1918623590599
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:44 GMT
AN-X-Request-Uuid
776d5cbe-76d0-405c-ae03-34f408e89898
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
www.google.com/pagead/1p-user-list/747356055/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/747356055/?random=1687290284478&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=427593068&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:44 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.ca/pagead/1p-user-list/747356055/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/pagead/1p-user-list/747356055/?random=1687290284478&cv=11&fst=1687287600000&bg=ffffff&guid=ON&async=1&gtm=45be36e0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=0&tiba=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=427593068&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:44 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ Frame 8819 		0
18 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.mercurynews.com
Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.mercurynews.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:44 GMT
priority
u=0,i
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
/
www.facebook.com/tr/ Frame 2501 		0
15 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.mercurynews.com
Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.mercurynews.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:45 GMT
priority
u=0,i
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
async_usersync
ib.adnxs.com/ Frame 869D 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:45 GMT
AN-X-Request-Uuid
98bd906b-32ac-41f5-85a3-31701c88404c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 9FBA 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
49961
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 05:52:04 GMT
expires
Wed, 19 Jun 2024 05:52:04 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
vevent
nym1-ib.adnxs.com/ Frame 88E1 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQirg8ikBhDWx4O9xdCKk30Y1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXicpQSAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFzSjFIcWdqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMU5UTXk0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGbkN1UUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhMTGdHQ2cuLpoCxQEhSHlOX193amcy_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qVTFNekpBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjU1MzLaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo2MTk3uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABSnhUMVZGb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpMU1IRUFBQUFBQUFBQUFIZ0FnUUVBQUFBKd0ASa0fMEpvQkFnZ0FxQUVBc1Fdj3xBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHnKUE0gcNCS63AIzaBwYIABAAGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=8fc2da3f437f964491d0b5f56e37b58b4f16632d&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=1615154911199896023&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:45 GMT
AN-X-Request-Uuid
f69387de-3e36-4d80-9591-7593a8651ff0
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 88E1 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvz-WOhx4Jho-AhqrtUpvh6hwAz4D24dXxE74mUybmynW0RDXIsn8Nv3tYUBZyG9-ByNLwum9X3zeyI0arLSc7-QUOSkB3-KrvYtGvvBMcUL3j4W1utqj5U_uAhfZao_eWK9IcsiDkWxhLfaVmbq0vBB3yBTOc3hUz6UD3JsA4pM8I&sai=AMfl-YSUY_3nYEwFZy6k2EnfTBmfp9ZkNCLqCgsaKLo03YLYAyzGFDVs4M8NTmTNSqrZRJcBEB9FNKbY1P3se09GK-7qlGxnYvcxz514rA&sig=Cg0ArKJSzL4b1jbXdEmVEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=163&vt=11&dtpt=160&dett=2&cstd=1&cisv=r20230615.12364&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=730607261;ord=fpd6a9;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P9bjoFeEKiZ91vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAvydVAwAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HyN__wjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjU1MzJA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1NTMy%2Fbn%3D70300%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=161;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:45 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame C6CB 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
539
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 2F14 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306140101&jk=2291221096554844&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
integrator.js
adservice.google.com/adsid/ 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2291221096554844&correlator=1266881451351149&eid=31075065%2C31075399%2C31075487&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Ctop_leaderboard&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=10&adks=142133714&didk=303353385&sfv=1-0-40&ris=1&rcs=3&prev_scp=pos%3Dtop_leaderboard%26confiant_refresh%3Dtrue%26htl_refresh%3D3&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D236787765623%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D2a155da8dea23fa8%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_MZag-KaHfPvInqD3jUyqai_PEpSaw&gpic=UID%3D00000c52bd207673%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_Ma5lMtSzeU4G6-9L7c_E3E1qQ58Kg&abxe=1&dt=1687290285183&lmt=1687290285&dlt=1687290276662&idt=1385&adxs=1515&adys=323&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=970x90&msz=970x90&fws=1028&ohw=1280&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvj90cD2IStBPePV2sU5XIZEsMBGkm5YuxQS6jiD838Iv3JaJi0pJmR-WBBxBdM_tb-RL2AkYWZf6FZVZvXTlxDnrsCfKOgg&ga_vid=461448689.1687290279&ga_sid=1687290280&ga_hid=1059800600&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjg6dnSjTFIAFICCGoSGQoKdWlkYXBpLmNvbRjs4dnSjTFIAFICCGQSGQoKcHViY2lkLm9yZxje5dnSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y7OHZ0o0xSABSAghk
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
89d1e5406901d328d618b04cccf1202df32f97bb2831137599bc642ab4b4dfd8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12932
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame 832D 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=84315670&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=1&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e8de6e633e5c2123495bc42259ab59f3be302805b34c9cb72e8ec8f82cdf9ba5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:45 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2291221096554844&correlator=1844416425883816&eid=31075065%2C31075399%2C31075487&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=8013%2Cmercurynews.com%2Cthings-to-do%2Centertainment%2Csponsorship_1&enc_prev_ius=%2F0%2F1%2F2%2F3%2F4&prev_iu_szs=300x50%7C320x50&ifi=11&adks=1140109686&didk=1622125026&sfv=1-0-40&ris=2&rcs=3&prev_scp=pos%3DSponsorship_1%26confiant_refresh%3Dtrue%26htl_refresh%3D3&eri=1&cust_params=htlbidid%3D20923%26is_testing%3Dno%26kv%3Dentertainment%252Cthings-to-do%252Ccelebrities%252Cmartha-ross%252Ccalifornia%26page%3Darticle%26content%3D%26RPN%3D236787765623%26rurl%3D%26articleid%3D9968021&sc=1&cookie=ID%3D2a155da8dea23fa8%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_MZag-KaHfPvInqD3jUyqai_PEpSaw&gpic=UID%3D00000c52bd207673%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_Ma5lMtSzeU4G6-9L7c_E3E1qQ58Kg&abxe=1&dt=1687290285223&lmt=1687290285&dlt=1687290276662&idt=1385&adxs=3075&adys=79&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=20&vis=1&psz=320x50&msz=320x50&fws=3076&ohw=1254&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvj90cD2IStBPePV2sU5XIZEsMBGkm5YuxQS6jiD838Iv3JaJi0pJmR-WBBxBdM_tb-RL2AkYWZf6FZVZvXTlxDnrsCfKOgg&ga_vid=461448689.1687290279&ga_sid=1687290280&ga_hid=1059800600&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjg6dnSjTFIAFICCGoSGQoKdWlkYXBpLmNvbRjs4dnSjTFIAFICCGQSGQoKcHViY2lkLm9yZxje5dnSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y7OHZ0o0xSABSAghk
Requested by
Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
dc66711d693eede838cc28b1823501a9dd062c6cbd6c51e7b5bca42c2cc95d9b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13203
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
dv-measurements3941.js
cdn.doubleverify.com/ Frame 069C 		536 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-measurements3941.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:45 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 10:24:03 GMT
Server
UploadServer
ETag
"245897220fbd1a0dfa41e714a5e3acf6"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=946080900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103853
Expires
Mon, 17 Jun 2024 10:24:07 GMT
/
www.facebook.com/tr/ Frame 74B2 		0
15 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.mercurynews.com
Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.mercurynews.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:45 GMT
priority
u=0,i
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 9FBA 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
539
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
dcm
s.amazon-adsystem.com/ Frame 8D66 		43 B
855 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=479CC621-B2E0-490D-8915-42055EBBC0EB&redir=true&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:45 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
Server
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Vary
Content-Type,Accept-Encoding,User-Agent
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid
69M93BY5XTVW0BB2XQBQ
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 6C91
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.206.101.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-101-164.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT

Redirect headers

content-length
95
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:44 GMT
location
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
ImgSync
image8.pubmatic.com/AdServer/ Frame A131
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
  • https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFRFVrN0pKQU1BQUNST3RPSXU5Zw&gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&b...
  • https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=syn%2Csas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
  • https://sync.technoratimedia.com/services?srv=cs&pid=73&uid=AAEDUk7JJAMAACROtOIu9g&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Cpp%252Cpm%26bee_sync_cu...
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=2
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEDUk7JJAMAACROtOIu9g&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=4777538607685951564&gdpr=0&gdpr_consent=
  • https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAEDUk7JJAMAACROtOIu9g&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D4777538607685951564%26gdpr%3D0%26gdpr_consen...
  • https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=4777538607685951564&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=4&ev=AAEDUk7...
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAEDUk7JJAMAACROtOIu9g&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5NjkmdGw9MTI5NjAw&piggybackCookie=08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

cache-control
no-store, no-cache, private
date
Tue, 20 Jun 2023 19:44:45 GMT
location
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 8D20
Redirect Chain
  • https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzAmdGw9MTI5NjAw&piggybackCookie=di_a029244c9d2a48d68c380
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.206.101.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-101-164.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT

Redirect headers

content-length
95
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:44 GMT
location
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 796E
Redirect Chain
  • https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=3321274862842215126&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.206.101.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-101-164.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT

Redirect headers

content-length
95
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:45 GMT
location
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame 7542
Redirect Chain
  • https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=TsbVTkjDjUpVk9xKT8TBSUrD3E1Vk9lFT8Zhr1Cj
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.206.101.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-206-101-164.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT

Redirect headers

content-length
95
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:43 GMT
location
https://rtb.adentifi.com/CookieSyncPubMatic&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
usersync
usersync.gumgum.com/ Frame CBEC 		35 B
250 B 		Document
General
Check archive.org
Download Go to
Full URL
https://usersync.gumgum.com/usersync?b=pbm&i=479CC621-B2E0-490D-8915-42055EBBC0EB
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
3.213.224.199 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-213-224-199.compute-1.amazonaws.com
Software
/
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
private, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:45 GMT
Expires
0
Pragma
no-cache
sd
us-u.openx.net/w/1.0/ Frame 832D 		43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=540245193&val=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:45 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT
Martin
crb.kargo.com/api/v1/dsync/ Frame 832D 		43 B
504 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://crb.kargo.com/api/v1/dsync/Martin?exid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.206.150.230 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-206-150-230.compute-1.amazonaws.com
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:45 GMT
X-Accel-Expires
0
Vary
Origin
Content-Type
image/gif
Cache-Control
no-cache, no-store, must-revalidate, private, max-age=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 UTC
sync
sync.bfmio.com/ Frame 832D 		0
425 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=187&uid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.70.0.189 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-70-0-189.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:44 GMT
syncMe
synchroscript.deliveryengine.adswizz.com/ Frame 832D 		0
397 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=mrtnsvr.com&idType=cookie&partnerUserId=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.229.88.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-229-88-75.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:44 GMT
X-Clacks-Overhead
GNU Terry Pratchett
X-Adswizz-request-id
e8b44170-0fa2-11ee-bd1c-0269462144d9
Connection
keep-alive
Content-Length
0
X-Application-Context
application:production
Instance-id
i-0479e2ffdf8f05108
479CC621-B2E0-490D-8915-42055EBBC0EB
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame 832D 		43 B
601 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/pubmatic/479CC621-B2E0-490D-8915-42055EBBC0EB?gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a01:1182:3903:eb81:31e2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
sn.ashx
pmp.mxptint.net/ Frame 832D
Redirect Chain
  • https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
  • https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=987f2e3bf4c23e8&is_secure=true&networkId=17100&version=1&nuid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAAHPMPxJ_kugQMC7ljAAAAAAAA&expiration=1687376685&nuid=479CC621-B2E0-490D-8915-42055EBBC0EB&...
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
  • https://pmp.mxptint.net/sn.ashx?&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjc0NCZ0bD0xNTc2ODAw&piggybackCookie=R33646_104945626_B755AE54&r=https://pmp.mxptint.net/sn.ashx?ak=1
  • https://pmp.mxptint.net/sn.ashx?ak=1
43 B
266 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pmp.mxptint.net/sn.ashx?ak=1
Protocol
HTTP/1.1
Server
38.98.69.175 New York, United States, ASN174 (COGENT-174, US),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Strict-Transport-Security max-age=-370295068; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
-1
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:45 GMT
Cache-Control
no-cache
Strict-Transport-Security
max-age=-370295068; includeSubDomains
Content-Length
43
Content-Type
image/gif

Redirect headers

location
https://pmp.mxptint.net/sn.ashx?ak=1
date
Tue, 20 Jun 2023 19:44:44 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
ImgSync
image8.pubmatic.com/AdServer/ Frame 832D
Redirect Chain
  • https://sync.ipredictive.com/d/sync/cookie/generic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=${ADELPHIC_CUID}&gdpr=0&gdpr_cons...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzI1MCZ0bD0xMjk2MDA=&piggybackCookie=dc345a35-a603-4ec3-b75a-7bd7631cedf4&gdpr=0&gdpr_consent=
  • https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
0
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
Protocol
H2
Server
8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:44 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
date
Tue, 20 Jun 2023 19:44:44 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Pug
simage2.pubmatic.com/AdServer/ Frame 832D
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
  • https://rtb2-useast.marketiq.com/sync?exchange=685&ssp=pubmatic&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://dsp.adkernel.com/adkuid?r=https%3A%2F%2Frtb2-useast.marketiq.com%2Fsync%3Fexchange%3D685%26ssp%3Dpubmatic%26bsw_param%3D2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://rtb2-useast.marketiq.com/sync?adkuid=A4735317727298828258&exchange=685&ssp=pubmatic&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://x.bidswitch.net/sync?dsp_id=458&user_id=A4735317727298828258&expires=5&ssp=pubmatic&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=&gdpr_pd=
1 B
185 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=&gdpr_pd=
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:45 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
1
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
//simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=&gdpr_pd=
Date
Tue, 20 Jun 2023 19:44:46 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
visit.js
tps.doubleverify.com/ Frame 069C 		724 B
750 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=116&ttfrms=37&brid=3&brver=114.0.5735.133&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=1625&ddur=127&uid=1687290285405267&jsCallback=dvCallback_1687290285405782&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3941&tgjsver=3941&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dbkbch%26e%3D1918623590599&fcifrms=26&brh=2&sdf=2&dvp_epl=196&noc=4&nav_pltfrm=Win32&ctx=13693614&cmp=29599255&sid=7119312&plc=364198308&crt=193069666&btreg=554237588&btadsrv=doubleclick&adsrv=1&advid=10627282&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=63641479146.7624&dvp_tukv=42737112060.77121&dvp_strhd=0.5&dvpx_strhd=0.5&dvp_tuid=1209709956472&jurtd=4089798382
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
3e812632066a1fa29f79d516c7e9b729bf8d96751d67c0ba607a7e004d8e5c97

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:45 GMT
Content-Encoding
br
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0
Connection
keep-alive
Timing-Allow-Origin
*
Expires
06/19/2023 19:44:45
dcmads.js
www.googletagservices.com/dcm/ Frame 582C 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:58:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2797
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:58:08 GMT
apn
beacon.sojern.com/imp/ Frame 582C 		42 B
229 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.sojern.com/imp/apn?auc=569283539013017630&cr=280383875&seg=&st=0&bp=0.02283&pp=0.02283&aaid=&idfa=&ord=380229093
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
119.244.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date
Tue, 20 Jun 2023 19:44:45 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
vary
Accept-Encoding
content-type
image/gif
ca
choices.truste.com/ Frame 582C 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=380229093&sz=300x250&js=st_dapp
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.106.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-106-32.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 264f765d2ad734b490f4728d6de8ce04.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P3
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
918
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
17L29DhFN_9RJaG3QwI9_3SN2XHgefsyCOhkzxPdRC2k9421kc8hhA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame 582C 		80 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:45 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27646
Expires
Wed, 19 Jun 2024 19:44:45 GMT
it
nym1-ib.adnxs.com/ Frame 582C 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QKZCvBMGQUAAAMA1gAFAQirg8ikBhCewOT6zIug8wcY1vWTicG84osuKjYJGoF4Xb9glz8R4SwYoUeokT8ZAAAAgML18D8h4SwYoUeokT8pG4EJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCDo9mFAVi5q5cBYABopq60AXjh2AOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgMjk0MDY4MSwgMCk7dWYoJ2knLCA0ODIzODM1LCAwKTt1ZignZycsIDEyNzI3MzIxLCANKQByAT3wlTgwMzgzODc1LCAwKTuSAv0DIU0yZ1hQUWpGOU5NVkVJT2oyWVVCR0FBZ3VhdVhBVEFBT0FCQUFFanFQMUR1MzhFTldBQmdmbWdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCeC0zQjJkeGZsel9CQWNmdHdkbmNYNWNfeVFFQUFBQUFBQUR3UDlrQgEKAQF0OERfZ0FadTJwZ0wxQWMzTXpEMllBZ0NnQWdHMUFnASIEQzkJCPBVREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xPV1UweU9qVXhOamZnQS1sRGdBVGMzc1VFaUFUdnJNc0VrQVFCbUFRQndRUUEBYgUBCE1rRQUIBQEYRFlCQUR4QgUMCQFYaUFXdktLa0YwNlFVZEh0SjdULXhCUUEVARR3UVdhbVoFAhA1UDhrRgEZHElOTTN6VF9SLigACDJRVQEb0EFBQUR3UC1BRjZ4SHdCWm5vaUFiNEJZbS1zd0dDQmdOVlUwU0lCZ0NRQmdHWUJnQ2hCcHFaBV4sYmtfcUFZRXNnWWtDHYAARR0MAEcdDABJHQw4dUFZS5oCmQEheXhVWlhnOgECMExtcmx3RWdBQ2dBTVoZbQhPZ2w9URRkQTZVTkoBvwEBDDhEOVIBCAkBBEJaCQgBAQRCaAEGCQEEQnAJCAEBBEJ4AQYJARBCNEFJazVk9A4BOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjgxNzAjTllNMjo1MTY32gQCCAHgBAHwBIOj2YUBiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFhQL6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG6CnaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB-HYA9IHDQkRMwExDNoHBggFCWjgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=ff04a9a365c8b4f8e7c649c2ddd5795ccde6dedb
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:45 GMT
AN-X-Request-Uuid
1107cd18-2c74-4b10-a156-5d820795a52b
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
container.html
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8194 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
5
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Wed, 19 Jun 2024 19:44:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7925 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
5
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:40 GMT
expires
Wed, 19 Jun 2024 19:44:40 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
async_usersync.html
acdn.adnxs.com/dmp/ Frame EA0F 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46995
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:45 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291011
X-Served-By
cache-lga13626-LGA, cache-yul12833-YUL
X-Timer
S1687290286.625456,VS0,VE0
rd_log
nym1-ib.adnxs.com/ Frame 32ED 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKbDfBMmwYAAAMA1gAFAQirg8ikBhD7ldmzqaO2lTwY1vWTicG84osuKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlC4vYxoWLmrlwFgAGimrrQBeND-BYABAYoBA1VTRJIBA0VVUpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEAigJodWYoJ2EnLCA0MjU0MjkwLCAwKTt1ZignaScBFAw2MDgyGRQ4ZycsIDExNjI0MDIyLCAwCSksYycsIDQwNjIwMDE3FRUscicsIDIxODMwODI4CUD0UwGSAr0EIXJtd01xZ2p4bjY4VEVMaTlqR2dZQUNDNXE1Y0JNQVE0QUVBQVNKRUlVTzdmd1ExWUFHQi1hQUJ3QUhnQWdBRUFpQUVBa0FFQm1BRUJvQUVRcUFFS3NBRUF1UUhGZ3NuY2E0c25QOEVCeFlMSjNHdUxKel9KQVFBQUFBQUFBTkFfMlFFQUFBQUFBQUR3UC1BQjFJZUVBdlVCY1g3YU9aZ0NBS0FDQWJVQ0FBQUFBTDBDQUFBQUFNQUNBTWdDQU5BQ0FOZ0NBT0FDQU9nQ0FQZ0NBSUFEQVpnREFhSURGd2l5a2NBc0VBWVlBUzFHVHlBME1nYzJORFl6TXpRem9nTVRDTUdQd0N3UUNoZ0JMUUFBZ0Q0eUEzVnVhN29EQ1U1WlRUSTZOakkzTU9BRDZVT0FCT21TNUFPSUJOQ1Q1QU9RQkFHWUJBSEJCQUFBQUFBAdYIQXlREeEgQUFBTmdFQVBFEeVgQUFBQ0lCZjR3cVFYVHBCUjBlMG50UDdFRgEaCQFAREJCUUFBUVBHRFdqMF95UVUFFxRLc2J0UDkyKAAAWgEoBQHwQ1BBXzRBVVM4QVhXdk1VRi1BWFMxSU1DZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUVlmaGV0UnVCNzFQNmdHQkxJR0pBa0FBBUkMQUFBQh2rBEJrARIJAQBDHRhETGdHQ2cuLpoCmQEhdHhRZDlRNkECXHVhdVhBU0FBS0FBeEg0WHJVYmdlOVQ4NjJRARBFRHBRMBFhDER3UDEdYQBGERgMQUFBRx0YAEcdGABIHRgQSGdBaVEREPBPRHdQdy4u2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20v8gIRCgZBRFZfSUQSBzQyNTQyOTDyAhIKBkNQR19JRBIIMTFpXhjyAgoKBUNQASg4ATDyAg0KCEFEVl9GUkVRERAcUkVNX1VTRVIFEAAMCSA0Q09ERRIA8gIzCghDUEcJD7gnTldVMVptTmhNell5TkdSbFpqTTBPRE01TURBd01EbGkuMWM4NDIz8gILCgdDUAk1HADyAhAKBUlPAYAEBzSJBgDyASEESU8VITgTCg9DVVNUT01fTU9ERUwBKxQA8gIaChYyFgAcTEVBRl9OQU0FmAgeCho2HQAIQVNUAT4QSUZJRUQBPhwNCghTUExJVAFN8LABMIADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjEwNDEjTllNMjo2Mjcw2gQCCAHgBAHwBLi9jGiIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAFDHgAANgFAeAFAfAF17ce-gUECAAQAJAGAJgGALgGAMEGCSQo8D_QBpgD2gYWChAJERkBoBAAGADgBgHyBgIIAIAHAYgHAKAHAboHCCoEMS0tLUAByAfQ_gXSBw0JETMBMQjaBwYBaHAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=1c3597042b578a865019f2f3f0ec0334f30d921f&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dvciuxsaem%26e%3D1918623590599,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dvciuxsaem%26e%3D1918623590599&
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:45 GMT
AN-X-Request-Uuid
c769504a-ed5c-4b70-90bc-efc4db4ff8b8
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame 32ED 		80 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:45 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27646
Expires
Wed, 19 Jun 2024 19:44:45 GMT
it
nym1-ib.adnxs.com/ Frame 32ED 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLtCvBMbQUAAAMA1gAFAQirg8ikBhD7ldmzqaO2lTwY1vWTicG84osuKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlC4vYxoWLmrlwFgAGimrrQBeND-BYABAYoBA1VTRJIBA0VVUpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEAigJodWYoJ2EnLCA0MjU0MjkwLCAwKTt1ZignaScBFAw2MDgyGRQ4ZycsIDExNjI0MDIyLCAwCSksYycsIDQwNjIwMDE3FRUscicsIDIxODMwODI4CUD0UwGSAr0EIXJtd01xZ2p4bjY4VEVMaTlqR2dZQUNDNXE1Y0JNQVE0QUVBQVNKRUlVTzdmd1ExWUFHQi1hQUJ3QUhnQWdBRUFpQUVBa0FFQm1BRUJvQUVRcUFFS3NBRUF1UUhGZ3NuY2E0c25QOEVCeFlMSjNHdUxKel9KQVFBQUFBQUFBTkFfMlFFQUFBQUFBQUR3UC1BQjFJZUVBdlVCY1g3YU9aZ0NBS0FDQWJVQ0FBQUFBTDBDQUFBQUFNQUNBTWdDQU5BQ0FOZ0NBT0FDQU9nQ0FQZ0NBSUFEQVpnREFhSURGd2l5a2NBc0VBWVlBUzFHVHlBME1nYzJORFl6TXpRem9nTVRDTUdQd0N3UUNoZ0JMUUFBZ0Q0eUEzVnVhN29EQ1U1WlRUSTZOakkzTU9BRDZVT0FCT21TNUFPSUJOQ1Q1QU9RQkFHWUJBSEJCQUFBQUFBAdYIQXlREeEgQUFBTmdFQVBFEeVgQUFBQ0lCZjR3cVFYVHBCUjBlMG50UDdFRgEaCQFAREJCUUFBUVBHRFdqMF95UVUFFxRLc2J0UDkyKAAAWgEoBQHwQ1BBXzRBVVM4QVhXdk1VRi1BWFMxSU1DZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUVlmaGV0UnVCNzFQNmdHQkxJR0pBa0FBBUkMQUFBQh2rBEJrARIJAQBDHRhETGdHQ2cuLpoCmQEhdHhRZDlRNkECXHVhdVhBU0FBS0FBeEg0WHJVYmdlOVQ4NjJRARBFRHBRMBFhDER3UDEdYQBGERgMQUFBRx0YAEcdGABIHRgQSGdBaVEREPDeRHdQdy4u2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQOMTA0MSNOWU0yOjYyNzDaBAIIAeAEAfAEuL2MaIgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAEOcNgFAeAFAfAF17ce-gUECAAQAJAGAJgGALgGAMEGASEwAADwP9AGmAPaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB9D-BdIHDQkRMwExCNoHBgFocBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=0757536f454d96907345e3df506583ed2fd523a0
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:45 GMT
AN-X-Request-Uuid
34c23cfe-c343-480e-b5b8-34c82a93e6ad
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
1654263f-1b53-4ccb-bbfd-1d341b18ce96.jpg
crcdn01.adnxs.com/creative/p/1041/2020/4/22/18403658/ Frame 32ED 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://crcdn01.adnxs.com/creative/p/1041/2020/4/22/18403658/1654263f-1b53-4ccb-bbfd-1d341b18ce96.jpg
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
nginx/1.19.0 /
Resource Hash
43129d7a4f2d9953ac97cf492c5ef5e3bd5ab06b34e5998b93b386d6485f2936

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Unused62
8096267
Date
Tue, 20 Jun 2023 19:44:45 GMT
Last-Modified
Wed, 22 Apr 2020 18:06:15 GMT
Server
nginx/1.19.0
x-amz-request-id
2bcebb0a-00e7-4a93-bd72-f8436c376767
ETag
"91e1013747d0e5c842e664e988ce8e7a"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
X-Clv-Request-Id
2bcebb0a-00e7-4a93-bd72-f8436c376767
Cache-Control
max-age=3888000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
17090
X-Clv-S3-Version
2.5
Expires
Fri, 04 Aug 2023 19:44:45 GMT
impl_v96.js
www.googletagservices.com/dcm/ Frame 582C 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:58:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42398
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 07:58:07 GMT
log
protected-by.clarium.io/ Frame 8194 		0
0
log
protected-by.clarium.io/ Frame 8194 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.107.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-107-2.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 8194 		0
0
log
protected-by.clarium.io/ Frame 7925 		0
0
log
protected-by.clarium.io/ Frame 7925 		0
221 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://protected-by.clarium.io/log
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.107.2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-107-2.compute-1.amazonaws.com
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Tue, 20 Jun 2023 19:44:45 GMT
content-encoding
gzip
server
nginx/1.18.0 (Ubuntu)
access-control-max-age
access-control-allow-methods
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
access-control-allow-headers
pixel
protected-by.clarium.io/ Frame 7925 		0
0
B25623876.299125333;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=569283539013017630;crid=280383875;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_CO...
ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/ Frame 582C 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B25623876.299125333;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=569283539013017630;crid=280383875;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3062143102;ord=qaz6yf;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FGoF4Xb9glz_hLBihR6iRPwAAAIDC9fA_4SwYoUeokT8bgXhdv2CXPx4gWc9cgOYH1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAA6h8AAAIAAACDUbYQudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAiST-sAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521yxUZXgjF9NMVEIOj2YUBGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjdA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjc%3D%2Fbn%3D60513%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=539;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
4a492a4579667f5a6ae2d81e7a9aa22222cba42ebe712f60b93eb3698d8c00cb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:46 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29633
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
views
prod-dfm-proxy-connext.azurewebsites.net/api/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=23c7b2911e37a18862bb7d8d9656a1d8&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:46 GMT
X-Powered-By
ASP.NET
views
prod-dfm-proxy-connext.azurewebsites.net/api/ 		90 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views?UserId=23c7b2911e37a18862bb7d8d9656a1d8&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC
Requested by
Host: cdn.czx5eyk0exbhwp43ya.biz
URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9

Request headers

source-system
Plugin
site-code
DFM
autoqa
false
accept-language
en-CA,en;q=0.9
settingskey
BANG,MERC
authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NTkyOTAyNzl9.fJ154bbrGYsf2wv9QmcQ3sP07xJ6snvuyMwyHwwtpts
ssid
a906cfb77ae49b23aa0e99140203bb5a
environment
prod
config-code
BANGWPPRODWAB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
application/json
access-control-allow-origin
*
accept
application/json
attr
MERC
location
System
Referer
https://www.mercurynews.com/
version
Version: 2.8.5

Response headers

Expires
-1
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:46 GMT
Content-Encoding
gzip
X-Server-Time
6/20/2023 7:44:46 PM
Server
Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Vary
Accept-Encoding
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Content-Length
193
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
vevent
nym1-ib.adnxs.com/ Frame 88E1 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQirg8ikBhDWx4O9xdCKk30Y1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXicpQSAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFzSjFIcWdqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMU5UTXk0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGbkN1UUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhMTGdHQ2cuLpoCxQEhSHlOX193amcy_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qVTFNekpBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjU1MzLaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo2MTk3uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABSnhUMVZGb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpMU1IRUFBQUFBQUFBQUFIZ0FnUUVBQUFBKd0ASa0fMEpvQkFnZ0FxQUVBc1Fdj3xBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHnKUE0gcNCS63AIzaBwYIABAAGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=8fc2da3f437f964491d0b5f56e37b58b4f16632d&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=1615154911199896023&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:46 GMT
AN-X-Request-Uuid
b589f6c1-b4eb-4861-a3e3-525936f1748f
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
script.js
acdn.adnxs-simple.com/strikeforce/ Frame ACD4 		122 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs-simple.com/strikeforce/script.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
f63b683b181032b37e4b8a3fe5d001edc0b40a8df47c66b7966e2e7242f0226d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Expires
Fri, 09 Jun 2023 07:05:17 GMT
Date
Tue, 20 Jun 2023 19:44:46 GMT
Content-Encoding
gzip
Via
1.1 varnish, 1.1 varnish
Age
45546
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
43711
X-Served-By
cache-lga13622-LGA, cache-yul12825-YUL
Last-Modified
Wed, 10 May 2023 16:21:53 GMT
Server
nginx/1.18.0 (Ubuntu)
X-Timer
S1687290286.263013,VS0,VE0
ETag
W/"645bc4a1-1e7fc"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=86402
Accept-Ranges
bytes
X-Cache-Hits
232, 32207
trk.js
cdn.adnxs.com/v/s/236/ Frame ACD4 		80 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27646
Expires
Wed, 19 Jun 2024 19:44:46 GMT
it
nym1-ib.adnxs.com/ Frame ACD4 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQirg8ikBhCLl7rC2q7Z4wQY1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjFpQWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFycDNZcHdqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMk5ESXg0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGbFRLUUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhMTGdHQ2cuLpoCxQEhSFNPdl9namcy_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qWTBNakZBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjY0MjHaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1Mjk1uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABR2hTWlVsb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpdktYRUFBQUFBQUFBQUFIZ0FnUUVBQUFBKd0ASa0fNEpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAfFpQXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=7dcbc8bc793b98de507c2b44c191dd0a3197ca97
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:46 GMT
AN-X-Request-Uuid
80c5b44c-3d13-42fd-aff7-e111d9b583c2
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 88E1 		42 B
174 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvrKTgYAsE3AptdJtDG5XnGXrsoeNb72tkBDEw_HLWoyWm8Etx-KdqRhZOzgRMAJ2IxK_11i_bLXv7AxwZik8XWIA3zybiuaeM&sig=Cg0ArKJSzE0uH1onDcytEAE&id=lidar2&mcvt=1042&p=0,0,250,300&mtos=1042,1042,1042,1042,1042&tos=1042,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=730607261&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687290283261&rpt=1870&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:46 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame 32ED 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLtCvBMbQUAAAMA1gAFAQirg8ikBhD7ldmzqaO2lTwY1vWTicG84osuKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlC4vYxoWLmrlwFgAGimrrQBeND-BYABAYoBA1VTRJIBA0VVUpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEAigJodWYoJ2EnLCA0MjU0MjkwLCAwKTt1ZignaScBFAw2MDgyGRQ4ZycsIDExNjI0MDIyLCAwCSksYycsIDQwNjIwMDE3FRUscicsIDIxODMwODI4CUD0UwGSAr0EIXJtd01xZ2p4bjY4VEVMaTlqR2dZQUNDNXE1Y0JNQVE0QUVBQVNKRUlVTzdmd1ExWUFHQi1hQUJ3QUhnQWdBRUFpQUVBa0FFQm1BRUJvQUVRcUFFS3NBRUF1UUhGZ3NuY2E0c25QOEVCeFlMSjNHdUxKel9KQVFBQUFBQUFBTkFfMlFFQUFBQUFBQUR3UC1BQjFJZUVBdlVCY1g3YU9aZ0NBS0FDQWJVQ0FBQUFBTDBDQUFBQUFNQUNBTWdDQU5BQ0FOZ0NBT0FDQU9nQ0FQZ0NBSUFEQVpnREFhSURGd2l5a2NBc0VBWVlBUzFHVHlBME1nYzJORFl6TXpRem9nTVRDTUdQd0N3UUNoZ0JMUUFBZ0Q0eUEzVnVhN29EQ1U1WlRUSTZOakkzTU9BRDZVT0FCT21TNUFPSUJOQ1Q1QU9RQkFHWUJBSEJCQUFBQUFBAdYIQXlREeEgQUFBTmdFQVBFEeVgQUFBQ0lCZjR3cVFYVHBCUjBlMG50UDdFRgEaCQFAREJCUUFBUVBHRFdqMF95UVUFFxRLc2J0UDkyKAAAWgEoBQHwQ1BBXzRBVVM4QVhXdk1VRi1BWFMxSU1DZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUVlmaGV0UnVCNzFQNmdHQkxJR0pBa0FBBUkMQUFBQh2rBEJrARIJAQBDHRhETGdHQ2cuLpoCmQEhdHhRZDlRNkECXHVhdVhBU0FBS0FBeEg0WHJVYmdlOVQ4NjJRARBFRHBRMBFhDER3UDEdYQBGERgMQUFBRx0YAEcdGABIHRgQSGdBaVEREPDeRHdQdy4u2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQOMTA0MSNOWU0yOjYyNzDaBAIIAeAEAfAEuL2MaIgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAEOcNgFAeAFAfAF17ce-gUECAAQAJAGAJgGALgGAMEGASEwAADwP9AGmAPaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB9D-BdIHDQkRMwExCNoHBgFocBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=0757536f454d96907345e3df506583ed2fd523a0&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=1615154911199896023&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:46 GMT
AN-X-Request-Uuid
3d2b97a4-2b7b-45e9-bd43-167de1595283
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
generate_204
tpc.googlesyndication.com/ Frame C6CB 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?t7ECTw
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
async_usersync
ib.adnxs.com/ Frame EA0F 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:46 GMT
AN-X-Request-Uuid
00f638bc-51e2-444f-8fcc-d3ed7d40c71c
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 9A8F 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:46 GMT
integrator.js
adservice.google.com/adsid/ Frame 9A8F 		107 B
122 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.mercurynews.com
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame 9A8F 		31 KB
13 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1359602464023610&correlator=2747867694955963&eid=31074760&output=ldjh&gdfp_req=1&vrg=202306140101&ptt=17&impl=fifs&gdpr_consent=tcunavailable&gdpr=0&tcfe=3&us_privacy=1---&iu_parts=21671350435%3A208595991%2C300x250-mercurynews.com&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=1&adks=187146907&didk=1653906094&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D2a155da8dea23fa8%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_MZag-KaHfPvInqD3jUyqai_PEpSaw&gpic=UID%3D00000c52bd207673%3AT%3D1687290279%3ART%3D1687290279%3AS%3DALNI_Ma5lMtSzeU4G6-9L7c_E3E1qQ58Kg&abxe=1&dt=1687290286327&lmt=1687290286&dlt=1687290282885&idt=393&adxs=2338&adys=874&biw=1600&bih=1200&isw=300&ish=250&scr_x=0&scr_y=0&btvi=0&ucis=yxgta8fgu285&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=2&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ref=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&top=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&frm=23&vis=1&psz=300x250&msz=300x0&fws=256&ohw=0&ea=0&ga_vid=461448689.1687290279&ga_sid=1687290286&ga_hid=765457681&ga_fc=true&a3p=EhsKDGlkNS1zeW5jLmNvbRjg6dnSjTFIAFICCGoSGQoKdWlkYXBpLmNvbRjs4dnSjTFIAFICCGQSGQoKcHViY2lkLm9yZxje5dnSjTFIAFICCGoSHQoOZXNwLmNyaXRlby5jb20Y7OHZ0o0xSABSAghk
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
f0ff4ab83bbeaad40a0e6b6a601254f492c04be8f80c99a787f27fb2cddee2be
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12984
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.mercurynews.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 9A8F 		15 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202306140101&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306140101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
852558e06b451f0305901a729b6f32a4297aee2e85b7c5bdcc0228c346e3a18f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11236
x-xss-protection
0
container.html
85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1668 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:46 GMT
expires
Wed, 19 Jun 2024 19:44:46 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 582C 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B25623876.299125333;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=569283539013017630;crid=280383875;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3062143102;ord=qaz6yf;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FGoF4Xb9glz_hLBihR6iRPwAAAIDC9fA_4SwYoUeokT8bgXhdv2CXPx4gWc9cgOYH1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAA6h8AAAIAAACDUbYQudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAiST-sAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521yxUZXgjF9NMVEIOj2YUBGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjdA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjc%3D%2Fbn%3D60513%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=539;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:46 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame 582C 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B25623876.299125333;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=569283539013017630;crid=280383875;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3062143102;ord=qaz6yf;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FGoF4Xb9glz_hLBihR6iRPwAAAIDC9fA_4SwYoUeokT8bgXhdv2CXPx4gWc9cgOYH1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAA6h8AAAIAAACDUbYQudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAiST-sAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521yxUZXgjF9NMVEIOj2YUBGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjdA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjc%3D%2Fbn%3D60513%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=539;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
5694
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 582C 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstqdOjqBESuPlAauIJdeqQbNpW9gvg_EPQXptm2eqIIYnTNPWixWRAbUhWdvuGcsqySd_N81TKXxk1l0wCMV2kFWFsDw_TdjWbOD905I0AnE8BhFt4f07-lD4Yu4fpPk1QoWaalDyzUnneUre_yI4ijVQwnuGvwu7ncWdMGzHqd&sai=AMfl-YTV6PW4JhCSM43H6FXlYeNiQ0Emi7OhZVfqaWplc7jnq_oGTkRwnUhwCOWaoN1Q_Bm8dtbMIAg3QraJe9InE6_kE1tmtcVTpSO7Ig&sig=Cg0ArKJSzHcZFr56jkxwEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=6&cbvp=1&cstd=0&cisv=r20230615.27674&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B25623876.299125333;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=569283539013017630;crid=280383875;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3062143102;ord=qaz6yf;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FGoF4Xb9glz_hLBihR6iRPwAAAIDC9fA_4SwYoUeokT8bgXhdv2CXPx4gWc9cgOYH1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAA6h8AAAIAAACDUbYQudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAiST-sAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521yxUZXgjF9NMVEIOj2YUBGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjdA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjc%3D%2Fbn%3D60513%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=539;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:46 GMT
ca
choices.truste.com/ Frame 582C 		28 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=25623876&js=st0
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B25623876.299125333;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=569283539013017630;crid=280383875;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3062143102;ord=qaz6yf;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FGoF4Xb9glz_hLBihR6iRPwAAAIDC9fA_4SwYoUeokT8bgXhdv2CXPx4gWc9cgOYH1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAA6h8AAAIAAACDUbYQudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAiST-sAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521yxUZXgjF9NMVEIOj2YUBGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjdA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjc%3D%2Fbn%3D60513%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=539;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.106.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-106-32.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
ddbfe856be75cfeef54986719f4f21277f748a9b7ebb948bfa0ef75332e6b753
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 264f765d2ad734b490f4728d6de8ce04.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P3
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
8031
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
HGQcPoitsPlwK6Ygf7qtGy3PbdFk7Tx67z8mU3--P24u2tT-sS1JBA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 582C 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B25623876.299125333;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=569283539013017630;crid=280383875;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3062143102;ord=qaz6yf;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FGoF4Xb9glz_hLBihR6iRPwAAAIDC9fA_4SwYoUeokT8bgXhdv2CXPx4gWc9cgOYH1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAA6h8AAAIAAACDUbYQudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAiST-sAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521yxUZXgjF9NMVEIOj2YUBGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjdA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjc%3D%2Fbn%3D60513%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=539;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:59:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42319
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 07:59:27 GMT
11310939852458276343
s0.2mdn.net/simgad/ Frame 582C 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/11310939852458276343
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tnhfdisl&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7b904860c3bb0a175261eb1073c9a2fa78da35d0e7f4d5146d58ca0c996b9fe7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:35:33 GMT
x-content-type-options
nosniff
age
558553
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
59332
x-xss-protection
0
last-modified
Mon, 06 Dec 2021 04:25:11 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 08:35:33 GMT
px
secure.adnxs.com/ Frame 582C
Redirect Chain
  • https://pixel.sojern.com/pixel/img/291730?p_v=1&f_v=v3_image&vid=hot
  • https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=18I0X57OKGIAKLB1x3NZDA&google_nid=sojern__adx_open_bidder_seat&sjrn_id=Fnd3SPj50dGvmJFnA7WDI-NSx8O9Y26i7IY4OHYg2TCWvdTElyvkqtA9WVeYBynR&s...
  • https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=Fnd3SPj50dGvmJFnA7WDI-NSx8O9Y26i7IY4OHYg2TCWvdTElyvkqtA9WVeYBynR&sjrn_r=aHR0cHM6Ly9zZWN1cmUuYWRueHMuY29tL3B4P2lkPTE1Mjg5NjEmdD0x&sjrn_...
  • https://secure.adnxs.com/px?id=1528961&t=1
0
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.adnxs.com/px?id=1528961&t=1
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tnhfdisl&e=1918623590599
Protocol
HTTP/1.1
Server
68.67.179.89 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:47 GMT
AN-X-Request-Uuid
f9073c9b-25bd-4ec8-84ec-a8b9ba8a2342
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/javascript; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

date
Tue, 20 Jun 2023 19:44:46 GMT
via
1.1 google
vary
Accept-Encoding
content-type
image/gif
location
https://secure.adnxs.com/px?id=1528961&t=1
p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
dcm
beacon.sojern.com/imp/ Frame 582C 		42 B
101 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.sojern.com/imp/dcm?auc=569283539013017630&io=${INSERTION_ORDER_ID}&li=${CAMPAIGN_ID}&cr=280383875&io=${INSERTION_ORDER_ID}&seg=${PIXEL_ID_COMMA}&src=${SOURCE_URL}&ord=%c
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tnhfdisl&e=1918623590599
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
119.244.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date
Tue, 20 Jun 2023 19:44:46 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
vary
Accept-Encoding
content-type
image/gif
ca
choices.trustarc.com/ Frame 582C 		27 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?sz=300x250&c=380229093&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02_d&cid=0&c=380229093&sz=300x250&js=st_dapp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
dedd1a2d0818c447fbbdc7f6b52091e5a4f2c8d558d8f8361a59ddfe8561cbdc
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
V5pwNhWjF_nG1yf_Yn63CoHb3C4tAaYpzqODLRc5yGKD1fZwEAB5JQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
1a
i.clean.gg/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://i.clean.gg/1a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.21.6 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://sopalk.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-max-age
1728000
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/plain; charset=utf-8
date
Tue, 20 Jun 2023 19:44:46 GMT
server
nginx/1.21.6
via
1.1 google
1a
i.clean.gg/ Frame ACD4 		0
104 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://i.clean.gg/1a
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.69.49 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
49.69.95.34.bc.googleusercontent.com
Software
nginx/1.21.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sopalk.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
via
1.1 google
server
nginx/1.21.6
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Range
access-control-allow-headers
DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
dcmads.js
www.googletagservices.com/dcm/ Frame ACD4 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:58:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2798
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:58:08 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 9A8F 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:44:46 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 582C 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstqdOjqBESuPlAauIJdeqQbNpW9gvg_EPQXptm2eqIIYnTNPWixWRAbUhWdvuGcsqySd_N81TKXxk1l0wCMV2kFWFsDw_TdjWbOD905I0AnE8BhFt4f07-lD4Yu4fpPk1QoWaalDyzUnneUre_yI4ijVQwnuGvwu7ncWdMGzHqd&sai=AMfl-YTV6PW4JhCSM43H6FXlYeNiQ0Emi7OhZVfqaWplc7jnq_oGTkRwnUhwCOWaoN1Q_Bm8dtbMIAg3QraJe9InE6_kE1tmtcVTpSO7Ig&sig=Cg0ArKJSzHcZFr56jkxwEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=239&vt=11&dtpt=233&dett=2&cstd=0&cisv=r20230615.27674&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N163801.2560713PROPERTYSOLUTIONS/B25623876.299125333;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;aucid=569283539013017630;crid=280383875;ioid=%24%7BINSERTION_ORDER_ID%7D;liid=%24%7BCAMPAIGN_ID%7D;segid=%24%7BPIXEL_ID_COMMA%7D;srcid=%24%7BSOURCE_URL%7D;dc_adk=3062143102;ord=qaz6yf;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3FGoF4Xb9glz_hLBihR6iRPwAAAIDC9fA_4SwYoUeokT8bgXhdv2CXPx4gWc9cgOYH1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAA6h8AAAIAAACDUbYQudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAiST-sAAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521yxUZXgjF9NMVEIOj2YUBGLmrlwEgACgAMZqZmZmZmbk_OglOWU0yOjUxNjdA6UNJAAAAAAAA8D9RAAAAAAAAAABZAAAAAAAAAABhAAAAAAAAAABpAAAAAAAAAABxAAAAAAAAAAB4AIkBAAAAAAAA8D8.%2Fcca%3DODE3MCNOWU0yOjUxNjc%3D%2Fbn%3D60513%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=539;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:46 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:46 GMT
container.html
85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6E27 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:821::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:46 GMT
expires
Wed, 19 Jun 2024 19:44:46 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
syncframe
gum.criteo.com/ Frame F166 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:46 GMT
server
Kestrel
server-processing-duration-in-ticks
754104
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
delete
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=23c7b2911e37a18862bb7d8d9656a1d8&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Request-Method
GET
Origin
https://www.mercurynews.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Headers
access-control-allow-origin,attr,authorization,autoqa,config-code,content-type,environment,location,settingskey,site-code,source-system,ssid,version
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:46 GMT
X-Powered-By
ASP.NET
delete
prod-dfm-proxy-connext.azurewebsites.net/api/views/user/ 		0
461 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://prod-dfm-proxy-connext.azurewebsites.net/api/views/user/delete?UserId=23c7b2911e37a18862bb7d8d9656a1d8&ConfigCode=BANGWPPRODWAB&SiteCode=DFM&SettingsKey=BANG%2CMERC&conversationId=104103
Requested by
Host: cdn.czx5eyk0exbhwp43ya.biz
URL: https://cdn.czx5eyk0exbhwp43ya.biz/prod/dfm/t8y9347t.min.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.85.16.224 San Antonio, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0, Microsoft-IIS/10.0 / ASP.NET, ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

source-system
Plugin
site-code
DFM
autoqa
false
accept-language
en-CA,en;q=0.9
settingskey
BANG,MERC
authorization
Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1bmlxdWVfbmFtZSI6IkNvbm5lWHQiLCJleHAiOjE3NTkyOTAyNzl9.fJ154bbrGYsf2wv9QmcQ3sP07xJ6snvuyMwyHwwtpts
ssid
a906cfb77ae49b23aa0e99140203bb5a
environment
prod
config-code
BANGWPPRODWAB
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type
application/json
access-control-allow-origin
*
accept
application/json
attr
MERC
location
System
Referer
https://www.mercurynews.com/
version
Version: 2.8.5

Response headers

Expires
-1
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:47 GMT
X-Server-Time
6/20/2023 7:44:47 PM
Server
Microsoft-IIS/10.0, Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET, ASP.NET
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
X-Server-Time,Request-Context
Cache-Control
no-cache
Content-Length
0
Request-Context
appId=cid-v1:b3b1c194-8bfe-45e5-8168-866947d4f019
gen_204
pagead2.googlesyndication.com/pagead/ Frame 9FBA 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Byl7arAGSZNWDJ-icoPMPpr6gkAgAAAAAOAHgBAI&bg=!1dal1oLNAAaGYqkwpmI7ADkAdvg8WrK8Th_H6s2Ow7nPL05EYefLhOIRJZvz7jPLjTDa0uNV1Wkb4wP-drG6gHbICMdz14ynDOwCAAAE1lIAAAADaAEHmQMRbUBdAtw3oFvDD0TLYsToRHwIrIg6685EUVhOGYeNRUiGX__Qs0-NlKK31aK30w3TurvtM_Seo-mzxSMtwMga7m9_cuKe5GZFrr1pAe3OCh0DxzsvWFGKz8uXt4uLPuSF_0vq8mKsBt73n_pH86UcCo8359COYU4TpElu2lu1AZPD6Kw3HgwSLltB6Eby7LqoMHCG0v1n7Z5gdvyz9WsODLm0w_juP5R6X_vqK6hMeCRKPU8nrx0oGHclrX7BjFJL_1gATtW73JuXomY4rFACY-T6b1qhdel1XAHrues6ZS1m79X9enXDZ5pExec_wwxC29AnYQ_xjk5QObFI1wXX7bZTFfW8tXrUF6NZhusqMWgh8wJ4knuj8Q35_MMbsCdOhZAKPcupY04ums9q7Pper-IVwglMs3AqG0j-_dynmjrxKuWZ9RdHcf_SNGV0-MROZTyjuwE1QZIvVPdHMHCdkCuXi-Yc1Vg_oh7MGsyuIYLLosgWL9RtesoesjB1HsyxvVZX6jGYc13zzrCsd5NqI4imWOgHLwxTcSxp4S-suUe9-4AyR4yya0Hls1WQaXl-tA7kyI3Pq6bTSbbUzxSbO0qjVNmHuqNaCKY4w18j1jIEWz8c7oN1N_WjglhLzeNPlUvJOVKWO0xjTf_RDVX6qPMGkpRMGRgaQCTmt7A8DAe3F6nZPT4afyYq3L2TQedGUdD44rTR7S-veR2z7xdONE_nL61Bm6JAOlLkJjY0RBJeX2eiYh363j5E95ZhuAqW1CFJFwpCX6hOYdfYZZrAukfY1HBbG-r4Ol_XDRb0H9DjcKJTqGctv0uXLKNyyi-tXzqTfZ_-c72U_0POj0oxxwshLtqMg7Uoek6kYbwxcoSMunF0Kdx75zEwDeXH2MhjswpGxbayYEJz2m8ZrTKUhpAzSfQpN5CB7GUuDYQZ84BUJ66_v2yfS1OdnGrDkkpQAr3mfNYmnFIGB7PgF25PnDUNaP7sKsegMKzdz-dG2kNxYwOoi4wvYP6v9hjbtS-TDojUvlifBhxyF3L91SufuGc
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame D889 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tnhfdisl&e=1918623590599
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46996
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:47 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291019
X-Served-By
cache-lga13626-LGA, cache-yul12833-YUL
X-Timer
S1687290287.412084,VS0,VE0
rd_log
nym1-ib.adnxs.com/ Frame 582C 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLODPBMTgYAAAMA1gAFAQirg8ikBhCewOT6zIug8wcY1vWTicG84osuKjYJGoF4Xb9glz8R4SwYoUeokT8ZAAAAgML18D8h4SwYoUeokT8pG4EJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCDo9mFAVi5q5cBYABopq60AXjh2AOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgMjk0MDY4MSwgMCk7dWYoJ2knLCA0ODIzODM1LCAwKTt1ZignZycsIDEyNzI3MzIxLCANKQByAT3wlTgwMzgzODc1LCAwKTuSAv0DIU0yZ1hQUWpGOU5NVkVJT2oyWVVCR0FBZ3VhdVhBVEFBT0FCQUFFanFQMUR1MzhFTldBQmdmbWdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCeC0zQjJkeGZsel9CQWNmdHdkbmNYNWNfeVFFQUFBQUFBQUR3UDlrQgEKAQF0OERfZ0FadTJwZ0wxQWMzTXpEMllBZ0NnQWdHMUFnASIEQzkJCPBVREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xPV1UweU9qVXhOamZnQS1sRGdBVGMzc1VFaUFUdnJNc0VrQVFCbUFRQndRUUEBYgUBCE1rRQUIBQEYRFlCQUR4QgUMCQFYaUFXdktLa0YwNlFVZEh0SjdULXhCUUEVARR3UVdhbVoFAhA1UDhrRgEZHElOTTN6VF9SLigACDJRVQEb0EFBQUR3UC1BRjZ4SHdCWm5vaUFiNEJZbS1zd0dDQmdOVlUwU0lCZ0NRQmdHWUJnQ2hCcHFaBV4sYmtfcUFZRXNnWWtDHYAARR0MAEcdDABJHQw4dUFZS5oCmQEheXhVWlhnOgECMExtcmx3RWdBQ2dBTVoZbQhPZ2w9URRkQTZVTkoBvwEBDDhEOVIBCAkBBEJaCQgBAQRCaAEGCQEEQnAJCAEBBEJ4AQYJARBCNEFJazVk4DhEOC7YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS_yAhEKBkFEVl9JRBIHMmkdHPICEgoGQ1BHARQACHEJGPICCgoFQ1ABFDgBMPICDQoIQURWX0ZSRVEREBxSRU1fVVNFUgUQABEJIDxDT0RFEgUzMzE5MfICIwoIAVYFFBgXMDBrMzkwAQFMcWt6b1NBQVFfZW5fNfICCwoHQ1AJJRwA8gIQCgVJTwF1BAc0aaYY8gIdCgdJTwkhDBIwMDYNRmBzWkthbUFBR_ICEwoPQ1VTVE9NX01PREVMAT0UAPICGgoWMhYAIExFQUZfTkFNRQEdCB4KGjYdAAhBU1QBPhBJRklFRAEhHA0KCFNQTElUAU3wmgEwgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQOODE3MCNOWU0yOjUxNjfaBAIIAeAEAfAEg6PZhQGIBQGYBQCgBf______AQUYAcAFAMkFAAUBFPA_0gUJCQULeAAAANgFAeAFAfAFhQL6BQQIABAAkAYAmAYAuAYAwQYBIDAAAPA_0AboKdoGFgoQCREZAaAQABgA4AYB8gYCCACABwGIBwCgBwG6BwgqBDEtLS1AAcgH4dgD0gcNCREzATEI2gcGAWhwGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=b7e1e936bd66900bae0ea523150deabd3f04fee9&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dtnhfdisl%26e%3D1918623590599,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dtnhfdisl%26e%3D1918623590599&
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=tnhfdisl&e=1918623590599
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:47 GMT
AN-X-Request-Uuid
1a8493e3-6afc-4014-9209-0d50688ad51a
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 12CA 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
46576
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 06:48:31 GMT
expires
Wed, 19 Jun 2024 06:48:31 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 129E 		783 B
534 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
37a534b757835254a2c961605454fd373e3c0dc789a8b7519b82868fa3d93346
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-WAoe_baoETK6p8zV_Bio3Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
512
content-security-policy
script-src 'report-sample' 'nonce-WAoe_baoETK6p8zV_Bio3Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:47 GMT
expires
Tue, 20 Jun 2023 19:44:47 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
impl_v96.js
www.googletagservices.com/dcm/ Frame ACD4 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:58:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42400
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 07:58:07 GMT
dcmads.js
www.googletagservices.com/dcm/ Frame D6BE 		16 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:58:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2799
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6830
x-xss-protection
0
last-modified
Wed, 24 May 2023 18:59:20 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
expires
Tue, 20 Jun 2023 19:58:08 GMT
trk.js
cdn.adnxs.com/v/s/236/ Frame D6BE 		80 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.adnxs.com/v/s/236/trk.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.184 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-184.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Jun 2023 12:59:52 GMT
Server
AkamaiNetStorage
ETag
"f0bafecba1d02c9fef00dbbaa8ee7f04:1686833992.592773"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=31536000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
27646
Expires
Wed, 19 Jun 2024 19:44:47 GMT
it
nym1-ib.adnxs.com/ Frame D6BE 		0
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nym1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwww.mercurynews.com%252F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQirg8ikBhCv9-Xti4CH4k8Y1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjLxAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFuNTMxb1FqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMU1qVTM0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGaVNtUUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhATGdHQ2cuLpoCxQEhSXlNcUE-_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qVXlOVGRBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjUyNTfaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1MDA0uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABOVJQUVMxb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpTUozRUFBQUFBQUFBQUFIZ0FnUUVBQUFBKd0ASa0fMEpvQkFnZ0FxQUVBc1Fdj3xBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHy8QF0gcNCS63AIzaBwYIABAAGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=af6d5196c2ed199ad19ea2e844c6e645f3df6b1e
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:47 GMT
AN-X-Request-Uuid
998b7f1d-4d4c-40fb-9c61-5539ccfa3e6a
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 0A5D 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
49963
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 05:52:04 GMT
expires
Wed, 19 Jun 2024 05:52:04 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
async_usersync.html
acdn.adnxs.com/dmp/ Frame B30B 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46997
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:47 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291020
X-Served-By
cache-lga13626-LGA, cache-yul12833-YUL
X-Timer
S1687290288.520788,VS0,VE0
/
csync.smilewanted.com/ Frame 00B5 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682294ea36372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:47 GMT
server
cloudflare
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame 3478 		281 B
401 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
233
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:47 GMT
etag
"40010-119-5ec73a0a33d00"
last-modified
Wed, 02 Nov 2022 02:30:44 GMT
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 3692 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165954
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:47 GMT
expires
Thu, 22 Jun 2023 17:50:41 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 8B0C
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=560288&ev=1&rurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D92%26partneruserid%3D%25%25VGUID%25%25&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=37Wunos71Ooo&ev=1&pid=560288&gdpr_consent=&gdpr=0
43 B
481 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=37Wunos71Ooo&ev=1&pid=560288&gdpr_consent=&gdpr=0
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

strict-transport-security
max-age=15768000
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server
Jetty(10.0.14)
content-language
en-CA
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=92&partneruserid=37Wunos71Ooo&ev=1&pid=560288&gdpr_consent=&gdpr=0
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-6d945594b4-b2vss
expires
-1
/
rtb-csync.smartadserver.com/redir/ Frame 8B0C
Redirect Chain
  • https://ad.turn.com/r/cs?pid=33&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D32%26partneruserid%3D%23USER_ID%23%26gdpr%3D%23GDPR_APPLICABLE%23%26gdpr_consent%...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=2889108176641716303&gdpr=0&gdpr_consent=
43 B
488 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=2889108176641716303&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=32&partneruserid=2889108176641716303&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:46 GMT
cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
/
rtb-csync.smartadserver.com/redir/ Frame 8B0C
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=
43 B
485 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

x-served-by
cache-yul12829-YUL
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687290288.521121,VS0,VE0
x-cache
HIT
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
/
rtb-csync.smartadserver.com/redir/ Frame 8B0C
Redirect Chain
  • https://visitor.omnitagjs.com/visitor/bsync?uid=627080440e659fbe0f85333c665ae1de&name=SMARTADSERVER&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D117%26partnerus...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=aba53805585c3b3f5f03fcf3ef82f98f&gdpr=0&gdpr_consent=0
43 B
525 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=aba53805585c3b3f5f03fcf3ef82f98f&gdpr=0&gdpr_consent=0
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
x-content-type-options
nosniff
server
ayl-lb-usa02
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=117&partneruserid=aba53805585c3b3f5f03fcf3ef82f98f&gdpr=0&gdpr_consent=0
p3p
CP="CAO PSA OUR"
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
1
content-length
0
expires
0
/
rtb-csync.smartadserver.com/redir/ Frame 8B0C
Redirect Chain
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
43 B
509 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
SPug
simage4.pubmatic.com/AdServer/ Frame 832D 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 17:54:50 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
vevent
nym1-ib.adnxs.com/ Frame 32ED 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLtCvBMbQUAAAMA1gAFAQirg8ikBhD7ldmzqaO2lTwY1vWTicG84osuKjYJD9b_OcyXJz8RnI96bvJyID8ZAAAAgML18D8hnI96bvJyID8pDtYJJPB5MQAAACCF67E_MO7fwQ04mFBAkQhIAlC4vYxoWLmrlwFgAGimrrQBeND-BYABAYoBA1VTRJIBA0VVUpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEAigJodWYoJ2EnLCA0MjU0MjkwLCAwKTt1ZignaScBFAw2MDgyGRQ4ZycsIDExNjI0MDIyLCAwCSksYycsIDQwNjIwMDE3FRUscicsIDIxODMwODI4CUD0UwGSAr0EIXJtd01xZ2p4bjY4VEVMaTlqR2dZQUNDNXE1Y0JNQVE0QUVBQVNKRUlVTzdmd1ExWUFHQi1hQUJ3QUhnQWdBRUFpQUVBa0FFQm1BRUJvQUVRcUFFS3NBRUF1UUhGZ3NuY2E0c25QOEVCeFlMSjNHdUxKel9KQVFBQUFBQUFBTkFfMlFFQUFBQUFBQUR3UC1BQjFJZUVBdlVCY1g3YU9aZ0NBS0FDQWJVQ0FBQUFBTDBDQUFBQUFNQUNBTWdDQU5BQ0FOZ0NBT0FDQU9nQ0FQZ0NBSUFEQVpnREFhSURGd2l5a2NBc0VBWVlBUzFHVHlBME1nYzJORFl6TXpRem9nTVRDTUdQd0N3UUNoZ0JMUUFBZ0Q0eUEzVnVhN29EQ1U1WlRUSTZOakkzTU9BRDZVT0FCT21TNUFPSUJOQ1Q1QU9RQkFHWUJBSEJCQUFBQUFBAdYIQXlREeEgQUFBTmdFQVBFEeVgQUFBQ0lCZjR3cVFYVHBCUjBlMG50UDdFRgEaCQFAREJCUUFBUVBHRFdqMF95UVUFFxRLc2J0UDkyKAAAWgEoBQHwQ1BBXzRBVVM4QVhXdk1VRi1BWFMxSU1DZ2dZRFZWTkVpQVlFa0FZQm1BWUFvUVlmaGV0UnVCNzFQNmdHQkxJR0pBa0FBBUkMQUFBQh2rBEJrARIJAQBDHRhETGdHQ2cuLpoCmQEhdHhRZDlRNkECXHVhdVhBU0FBS0FBeEg0WHJVYmdlOVQ4NjJRARBFRHBRMBFhDER3UDEdYQBGERgMQUFBRx0YAEcdGABIHRgQSGdBaVEREPDeRHdQdy4u2AIA4AKbhU7qAhxodHRwczovL3d3dy5tZXJjdXJ5bmV3cy5jb20vgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQOMTA0MSNOWU0yOjYyNzDaBAIIAeAEAfAEuL2MaIgFAZgFAKAF____________AcAFAMkFAAAAAAAA8D_SBQkJAAAAAAEOcNgFAeAFAfAF17ce-gUECAAQAJAGAJgGALgGAMEGASEwAADwP9AGmAPaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB9D-BdIHDQkRMwExCNoHBgFocBgA4AcA6gcCCADwB5GACIoIAhAAlQgAAIA_mAgB&s=0757536f454d96907345e3df506583ed2fd523a0&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=1615154911199896023&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:47 GMT
AN-X-Request-Uuid
3faed693-fa18-4543-86d7-7d7f78004c46
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 6E27 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CKQJ1rgGSZICAGf6joPwP15-SiAvamImHa8-ppu-ODsCNtwEQASAAYP3oooHwA4IBF2NhLXB1Yi0yMTI4NzU3MTY3ODEyNjYzyAEJ4AIAqAMBqgTxAk_QH1RO5brvyWScDA9c7wN42K4Rs8cRuvT_qW-7UobWh_2yYOC2ZNIlOuXT_zrqCb3B7s0pu3tzfBHYJPbzgaafdjl2EPwmR7XJIEMJMuiH4I8VnBI7u-Q15N-V2RllGII-5ssEswqJo15dA9RsrVVl3PWeC9-0E_wiBbij0sEa1oBY3xNm8pTpo1WcPBGvfcEqxEAkgLPmdu6sjZn1Bep-RGVKx9Y0txD78tz1yjTohQB7_vOINyAHtjDYO7QiMLri5LjfHFVspdZ1h5Y4NqFGDl1S8iR-EUAy6jIQaA9AglaALF8hj6SRvWfjJ2QKk3GOjiBRjnM0Ru1qQ2UOIsDGxG7pSxO8zdAE3c0VTqm32JY1y3BF5YOsoGxXAXcV6hHMN-9jED9qw7dSq8XFhw1n2lYtNVZs9cor8wzwK1w-Dt5NbCrMhv20ryw4Rbk91SFeNHHnSrF_qyYmKy95YgTLdGJS3Nz9JJxm1TuSAOgiNeAEAYAG8_repLLulOXyAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA0IgGEQATICigI6AoBAgAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTIxMjg3NTcxNjc4MTI2NjMY3O1q&sigh=4yL-QFpWL3E&uach_m=[UACH]&cid=CAQSOwBygQiD0W2oCiasN4VDNzCCS1PWkWtYgiF-hopJ2E178r4Rxk6cDMn1UW2Qy39PP5763CCFwCgMfkc8GAE
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
win
8proof.com/app/ Frame 6E27 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://8proof.com/app/win?id=515457626221&ap=ZJIBrgAGQAAJiBH-AASP1zOnRTMZlV_S4Qn6Dw&t=b
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.116.53.150 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
96.35.7434.ip4.static.sl-reverse.com
Software
nginx /
Resource Hash

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:47 GMT
content-length
0
server
nginx
5111
8proof.com/app/rtbmarkup/ Frame 5457 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://8proof.com/app/rtbmarkup/5111?id=515457626221&ctd=110096&crid=1178&ap=ZJIBrgAGQAAJiBH-AASP1zOnRTMZlV_S4Qn6Dw
Requested by
Host: 85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
URL: https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.116.53.150 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
96.35.7434.ip4.static.sl-reverse.com
Software
nginx /
Resource Hash
01407ea5c2e7ca3f46076f1f2f8df4b6e998580414789406dff50f183497f6b7

Request headers

Referer
https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-encoding
gzip
content-type
text/html;charset=utf-8
date
Tue, 20 Jun 2023 19:44:47 GMT
server
nginx
vary
Accept-Encoding
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230615/r20110914/client/ Frame 6E27 		19 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230615/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: 85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
URL: https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
30dd4d046ee0a560951014c2c3f71fb0b620af27279bd7c5ff8b4ac877214291
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 16:08:20 GMT
content-encoding
br
x-content-type-options
nosniff
age
12987
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8121
x-xss-protection
0
server
cafe
etag
8940155340736220798
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 16:08:20 GMT
l
www.google.com/ads/measurement/ Frame 6E27 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSNX0idP7dI9h7TRKiMLsSMVB90fjH3ETIqVQTNGniT5l_j_vm-iA2v3Bv3c8vUHqCFObx6xK69S_bgs3Q5TkDw_z94dw
Requested by
Host: 85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
URL: https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::2004 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 6E27 		24 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: 85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
URL: https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 05:52:03 GMT
content-encoding
br
x-content-type-options
nosniff
age
49964
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 19 Jun 2024 05:52:03 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 6E27 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: 85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
URL: https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:47 GMT
sid
mug.criteo.com/ Frame F166
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=mercurynews.com&sn=ChromeSyncframe&so=3&topUrl=www.mercurynews.com&bundle=_IOwol90amV0bXg2enFNMG9EVXhtTGp1MmhEZzNiVXBLOXFMT1laa1NCOWxudmVW...
  • https://mug.criteo.com/sid?cpp=YugKPnxEVVNrMWtVRFJqV0wxWUlhblN0VTFaQWxjb0NuQjI1YjFvQkNtTUhFSFkxdW1VMzVWWHpJKzBSRGFadXZvelpKYS9VTDl4czE4OUt3UVZoaFNwWnJ1Tkc4STdiVTRyLzZTdnIxTDY3bFY0ZnlUdzdrY1VkaE1tOX...
441 B
659 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=YugKPnxEVVNrMWtVRFJqV0wxWUlhblN0VTFaQWxjb0NuQjI1YjFvQkNtTUhFSFkxdW1VMzVWWHpJKzBSRGFadXZvelpKYS9VTDl4czE4OUt3UVZoaFNwWnJ1Tkc4STdiVTRyLzZTdnIxTDY3bFY0ZnlUdzdrY1VkaE1tOXRUdzlJS2tScjZyK09GNWtpRGhDTzhocDk5ckJScTNuU0pUV1lyS1ppY2JPY2RyZkNEWTFtMi81dnJINS90SUNpeENJa0t5WHd0Ni82Qnhrc3FrZDNjWUFMbmh3a2ZlNTd0WG1MZ0ZTa1BRN2trd2crYjlOMTNjVjRGTFNxSnNCeE14ZWYvdGsrWXNycU1ZOFU2di9qV0FhTWxlb2VnT1dZakRyQXpGc0p0T1E1Q3R4amNNaz18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
473f6dfb35695d59f6d67bc6a28f9fcec4a1b7b1f37974543f7923aff9118615
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
819909
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=YugKPnxEVVNrMWtVRFJqV0wxWUlhblN0VTFaQWxjb0NuQjI1YjFvQkNtTUhFSFkxdW1VMzVWWHpJKzBSRGFadXZvelpKYS9VTDl4czE4OUt3UVZoaFNwWnJ1Tkc4STdiVTRyLzZTdnIxTDY3bFY0ZnlUdzdrY1VkaE1tOXRUdzlJS2tScjZyK09GNWtpRGhDTzhocDk5ckJScTNuU0pUV1lyS1ppY2JPY2RyZkNEWTFtMi81dnJINS90SUNpeENJa0t5WHd0Ni82Qnhrc3FrZDNjWUFMbmh3a2ZlNTd0WG1MZ0ZTa1BRN2trd2crYjlOMTNjVjRGTFNxSnNCeE14ZWYvdGsrWXNycU1ZOFU2di9qV0FhTWxlb2VnT1dZakRyQXpGc0p0T1E1Q3R4amNNaz18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
270547
content-length
0
expires
0
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1059800600&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=MeterStart&el=%7B%22ConversationName%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ConversationDateStarted%22%3A%22Not%20Set%22%2C%22ConversationDateEnded%22%3A%22Not%20Set%22%2C%22ConversationDateExpiratation%22%3A%22Not%20Set%22%2C%22ConversationPaywallLimit%22%3A%22Not%20Set%22%2C%22ArticleViews%22%3A%22Not%20Set%22%7D&_u=aCDACEAjBAAAACgFKAC~&jid=&gjid=&cid=461448689.1687290279&tid=UA-61435456-5&_gid=183842644.1687290279&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=Not%20Set&cd96=Not%20Set&cd97=Not%20Set&cd98=Not%20Set&cd100=1687290287715.vvdl1if&cd101=23c7b2911e37a18862bb7d8d9656a1d8&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=Not%20Set&cd108=Not%20Set&cd109=Not%20Set&cd110=Not%20Set&cd111=Not%20Set&cd112=Not%20Set&cd113=Not%20Set&cd114=Not%20Set&cd115=Not%20Set&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=78771608
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 09:01:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
38622
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
css
fonts.googleapis.com/ 		8 KB
745 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,300&G2I_ActionId=120521&returnUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%3FclearUserState%3Dtrue
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
124f165a1243b48bd2ac21cebd8852c818c5deb7692fbfb5c80f5d5b72625da9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 20 Jun 2023 19:44:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 20 Jun 2023 18:18:36 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 20 Jun 2023 19:44:47 GMT
truncated
/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cd0b7385c8a691d9b2e7af11f3fbe1e7b1f42ecf11531882594908bf4a1b830e

Request headers

Referer
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
application/x-font-woff2;charset=utf-8
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pv&page=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&metered=1%7C2&metername=BANG%20Klay%20Production%20Conv&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&tid=bbf2d382-9f4f-4ae2-a7e6-843f46fd568c&pid=2d10aa57-19ef-4ec0-84a8-3899d30f307c&dtm=1687290287858&qnm=_matherq&visible=1&tabid=40005137-57dc-449b-98c4-09fff3481006&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x10480&tofa=1687290279&vid=1&lvidt=1687290279&duid=1bfd33dc-1dec-4854-b026-244377afad71&fp=967226427&cid=ma23578&mrk=239876506&cx=eyJhY3Rpb24iOnsiY2F0ZWdvcnkiOiJkaXNwbGF5IiwiYWN0aW9uIjoiYmFubmVyIiwiZGF0YSI6eyJtZXRlciI6eyJpZCI6IjIiLCJuYW1lIjoiTWV0ZXJlZCIsIm1ldGhvZCI6IkRlZmF1bHQifSwiY2FtcGFpZ24iOnsiaWQiOiIxMDE0MTgiLCJuYW1lIjoiQkFORyB3b3JkIHByZXNzIHcvYWRibG9jayJ9LCJjb252ZXJzYXRpb24iOnsibmFtZSI6IkJBTkcgS2xheSBQcm9kdWN0aW9uIENvbnYiLCJvcmRlciI6IjIifSwiYWN0aW9uIjp7Im5hbWUiOiJhLXRvYXN0ZXItc3ViLXB2MS1tZzJwdzA1LWZsYXNoIiwidHlwZUlkIjoiMSIsInR5cGVOYW1lIjoiYmFubmVyIiwib3JkZXIiOiIyIn19LCJ2ZW5kb3IiOiJtZzIiLCJ0eXBlIjoidW5rbm93biJ9LCJpZGVudGl0aWVzIjpbeyJ0eXBlIjoiZ2EiLCJpZCI6IjQ2MTQ0ODY4OSIsInJlZlRpbWUiOiIxNjg3MjkwMjg3ODU3In0seyJ0eXBlIjoibWcyIiwiaWQiOiIyM2M3YjI5MTFlMzdhMTg4NjJiYjdkOGQ5NjU2YTFkOCIsInJlZlRpbWUiOiIxNjg3MjkwMjg3ODM3In1dLCJhdWRpZW5jZSI6W3sicHJvdmlkZXIiOiJ1c2VyREIiLCJzZWdtZW50cyI6WyJNQVRIRVJfVTlfSU5TVEFOVEFfMjAyMDAyMDMiXSwicGFnZUlkIjoiMmQxMGFhNTctMTllZi00ZWMwLTg0YTgtMzg5OWQzMGYzMDdjIn0seyJwcm92aWRlciI6ImlTZWdzIiwic2VnbWVudHMiOlsiTUFUSEVSX1U5X0lOU1RBTlRBXzIwMjAwMjAzIl0sInBhZ2VJZCI6IjJkMTBhYTU3LTE5ZWYtNGVjMC04NGE4LTM4OTlkMzBmMzA3YyJ9XSwibWcyRGF0YSI6eyJ2ZXJzaW9uIjoiVmVyc2lvbjogMi44LjUiLCJlbnZpcm9ubWVudCI6InByb2QiLCJhdXRoU3lzdGVtIjoiQXV0aDBVbml2ZXJzYWxMb2dpbiIsImNhbXBhaWduTmFtZSI6IkJBTkcgd29yZCBwcmVzcyB3L2FkYmxvY2siLCJjYW1wYWlnbklkIjoiMTAxNDE4Iiwic3Vic2NyaXB0aW9ucyI6W10sImNvbnZlcnNhdGlvbiI6eyJJZCI6IjEwNDAwMCIsIkNvZGUiOiIxMDQwMDAiLCJOYW1lIjoiQkFORyBLbGF5IFByb2R1Y3Rpb24gQ29udiIsIk9yZGVyIjoiMiIsIlByb3BlcnRpZXMiOnsiUGF5d2FsbExpbWl0IjoiMiIsIlZpZXdzIjoiMSIsIkRhdGUiOnsiRXhwaXJhdGlvbiI6IjIwMjMtMDgtMTlUMTk6NDQ6NDcuMjIzWiIsIlN0YXJ0ZWQiOiIyMDIzLTA2LTIwVDE5OjQ0OjQ3LjIyM1oifSwiQXJ0aWNsZUxlZnQiOiIxIiwiVmlld1R5cGUiOiJDb252ZXJzYXRpb24iLCJQYXl3YWxsSW5mbyI6eyJBcnRpY2xlTGVmdCI6eyJDb252ZXJzYXRpb24iOiIxIiwiTWV0ZXIiOiJ1bmxpbWl0ZWQifSwiTGltaXQiOnsiQ29udmVyc2F0aW9uIjoiMiIsIk1ldGVyIjoidW5saW1pdGVkIn0sIk1pblZpZXciOiJDb252ZXJzYXRpb24ifX19fSwidXNlckRhdGEiOnsibWcyRGF0YSI6eyJPd25lZFN1YnNjcmlwdGlvbnMiOltdLCJBdXRoU3lzdGVtIjoiQXV0aDBVbml2ZXJzYWxMb2dpbiIsIkRpZ2l0YWxBY2Nlc3MiOnsiQWNjZXNzTGV2ZWwiOnt9LCJTdWJzY3JpcHRpb24iOltdfSwiSWdtUmVnSUQiOm51bGwsIkVtYWlsIjoiIiwiTnp3TGlkIjpudWxsLCJNYXN0ZXJJZCI6bnVsbCwiRGlzcGxheU5hbWUiOiIiLCJFbWFpbFByZWZlcmVuY2VzIjpudWxsLCJBZGREYXRlIjpudWxsfX19
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:47 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1059800600&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=ActionShown&el=%7B%22ConversationName%22%3A%22BANG%20Klay%20Production%20Conv%22%2C%22MeterLevel%22%3A%22Metered%22%2C%22ActionName%22%3A%22a-toaster-sub-pv1-mg2pw05-flash%22%2C%22ActionType%22%3A%22Banner%22%7D&_u=aCDACEAjBAAAACgFKAC~&jid=&gjid=&cid=461448689.1687290279&tid=UA-61435456-5&_gid=183842644.1687290279&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=Not%20Set&cd96=Not%20Set&cd97=Not%20Set&cd98=Not%20Set&cd100=1687290287875.uz4ib6sg&cd101=23c7b2911e37a18862bb7d8d9656a1d8&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=BANG%20Klay%20Production%20Conv&cd108=1&cd109=1&cd110=2&cd111=2023-06-20T19%3A44%3A47Z&cd112=Not%20Set&cd113=2023-08-19T19%3A44%3A47Z&cd114=a-toaster-sub-pv1-mg2pw05-flash&cd115=Banner&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=522299975
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 09:01:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
38622
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1059800600&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=SetTimer&_u=aCDACEAjBAAAACgFKAC~&jid=&gjid=&cid=461448689.1687290279&tid=UA-61435456-5&_gid=183842644.1687290279&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=11098&cd96=7121&cd97=Not%20Set&cd98=Not%20Set&cd100=1687290287934.kbi8t6m6&cd101=23c7b2911e37a18862bb7d8d9656a1d8&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=BANG%20Klay%20Production%20Conv&cd108=1&cd109=1&cd110=2&cd111=2023-06-20T19%3A44%3A47Z&cd112=Not%20Set&cd113=2023-08-19T19%3A44%3A47Z&cd114=Timer&cd115=Banner&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=1936978571
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 09:01:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
38622
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j100&a=1059800600&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&ul=en-us&de=UTF-8&dt=Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=G2I.Connext&ea=PageView&el=%7B%22Page%22%3A%22Meghan%20Markle%20earned%20more%20than%20The%20Weeknd%20for%20%2712%20hours%20work%27%3A%20Spotify%22%2C%22ContentType%22%3A%22Not%20Set%22%2C%22MeterLevel%22%3A%22Metered%22%7D&_u=aCDACEAjBAAAACgFKAC~&jid=&gjid=&cid=461448689.1687290279&tid=UA-61435456-5&_gid=183842644.1687290279&gtm=45He36e0n81NFD2QGD&cd3=mercurynews.com&cd121=Not%20Set&cd95=11098&cd96=7121&cd97=Not%20Set&cd98=Not%20Set&cd100=1687290287947.4idfec0i&cd101=23c7b2911e37a18862bb7d8d9656a1d8&cd102=Not%20Set&cd103=Not%20Set&cd104=Not%20Set&cd105=Unknown&cd106=Metered&cd107=BANG%20Klay%20Production%20Conv&cd108=1&cd109=1&cd110=2&cd111=2023-06-20T19%3A44%3A47Z&cd112=Not%20Set&cd113=2023-08-19T19%3A44%3A47Z&cd114=Timer&cd115=Banner&cd116=article&cd117=Not%20Set&cd119=Not%20Set&cd120=Default&cd122=1.0.0.2&cd123=Not%20Set&z=111089244
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 09:01:05 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
38622
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
B29599255.364198308;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=3210668679;ord=8huv23;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97L...
ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/ Frame ACD4 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;dc_eid=40004001;sz=300x250;u_sd=1;gdpr=0;dc_adk=3210668679;ord=8huv23;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P4uLTqh1ZccE1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAbydt5gAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521HSOv_gjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjY0MjFA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo2NDIx%2Fbn%3D86725%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=661;prcl=s
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
d666d7eced304e81fefa53e0f5305989a4ac2d9c264787886103643f3e840fa9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30030
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
usync.js
eus.rubiconproject.com/ Frame 3478 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
content-encoding
gzip
last-modified
Tue, 20 Jun 2023 08:41:09 GMT
server
Apache/2.2.15 (CentOS)
x-powered-by
PHP/5.3.3
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control
max-age=46557
content-length
10113
expires
Wed, 21 Jun 2023 08:40:45 GMT
montserrat-v25-latin-800.woff2
cdn.8proof.com/ads/assets/fonts/ Frame 5457 		0
0
montserrat-v25-latin-600.woff2
cdn.8proof.com/ads/assets/fonts/ Frame 5457 		0
0
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,300&G2I_ActionId=120521&returnUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%3FclearUserState%3Dtrue
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 13 Jun 2023 22:34:53 GMT
x-content-type-options
nosniff
age
594595
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48412
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 12 Jun 2024 22:34:53 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,300&G2I_ActionId=120521&returnUrl=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F%3FclearUserState%3Dtrue
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:820::2003 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.mercurynews.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 13 Jun 2023 22:34:53 GMT
x-content-type-options
nosniff
age
594595
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48412
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:08:53 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 12 Jun 2024 22:34:53 GMT
a48df6dd-06f8-4c09-93f6-dc5fecfa39da
https://www.mercurynews.com/ 		390 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://www.mercurynews.com/a48df6dd-06f8-4c09-93f6-dc5fecfa39da
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Length
390
Content-Type
text/javascript
activeview
pagead2.googlesyndication.com/pcs/ Frame 582C 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv1khfY14W34FwJqJrT2q-Swrqt8dA9zz6xbBZ5Ys6GcHwge91FRgEzqvLqkmrGEC1D08NNoxVQPC7Cb-owAZNwXOg5A6HZ&sig=Cg0ArKJSzD76O5ss9JiTEAE&id=lidar2&mcvt=1395&p=0,0,250,300&mtos=1395,1395,1395,1395,1395&tos=1395,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=3062143102&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687290283249&rpt=3529&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
impl_v96.js
www.googletagservices.com/dcm/ Frame D6BE 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/dcm/impl_v96.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:58:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42401
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20157
x-xss-protection
0
last-modified
Mon, 22 May 2023 16:41:33 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
vary
Accept-Encoding
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 07:58:07 GMT
vevent
nym1-ib.adnxs.com/ Frame 582C 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKZCvBMGQUAAAMA1gAFAQirg8ikBhCewOT6zIug8wcY1vWTicG84osuKjYJGoF4Xb9glz8R4SwYoUeokT8ZAAAAgML18D8h4SwYoUeokT8pG4EJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCDo9mFAVi5q5cBYABopq60AXjh2AOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgMjk0MDY4MSwgMCk7dWYoJ2knLCA0ODIzODM1LCAwKTt1ZignZycsIDEyNzI3MzIxLCANKQByAT3wlTgwMzgzODc1LCAwKTuSAv0DIU0yZ1hQUWpGOU5NVkVJT2oyWVVCR0FBZ3VhdVhBVEFBT0FCQUFFanFQMUR1MzhFTldBQmdmbWdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCeC0zQjJkeGZsel9CQWNmdHdkbmNYNWNfeVFFQUFBQUFBQUR3UDlrQgEKAQF0OERfZ0FadTJwZ0wxQWMzTXpEMllBZ0NnQWdHMUFnASIEQzkJCPBVREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xPV1UweU9qVXhOamZnQS1sRGdBVGMzc1VFaUFUdnJNc0VrQVFCbUFRQndRUUEBYgUBCE1rRQUIBQEYRFlCQUR4QgUMCQFYaUFXdktLa0YwNlFVZEh0SjdULXhCUUEVARR3UVdhbVoFAhA1UDhrRgEZHElOTTN6VF9SLigACDJRVQEb0EFBQUR3UC1BRjZ4SHdCWm5vaUFiNEJZbS1zd0dDQmdOVlUwU0lCZ0NRQmdHWUJnQ2hCcHFaBV4sYmtfcUFZRXNnWWtDHYAARR0MAEcdDABJHQw4dUFZS5oCmQEheXhVWlhnOgECMExtcmx3RWdBQ2dBTVoZbQhPZ2w9URRkQTZVTkoBvwEBDDhEOVIBCAkBBEJaCQgBAQRCaAEGCQEEQnAJCAEBBEJ4AQYJARBCNEFJazVk9A4BOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjgxNzAjTllNMjo1MTY32gQCCAHgBAHwBIOj2YUBiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFhQL6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG6CnaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB-HYA9IHDQkRMwExDNoHBggFCWjgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=ff04a9a365c8b4f8e7c649c2ddd5795ccde6dedb&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=1615154911199896023&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:48 GMT
AN-X-Request-Uuid
18a2e591-1800-43f0-92db-667925354419
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame D889 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:48 GMT
AN-X-Request-Uuid
fb582f21-eb44-4813-ba56-70d205317db8
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 129E 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202306140101&jk=1359602464023610&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 00B5 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152254
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da6822e2c8b6372-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306140101&jk=2291221096554844&bg=!7O-l77vNAAaGYqkwpmI7ADkAdvg8WjXZmhtKL5rOGHg9vf9-X6Ks4_5Iw-fmBRRBfIgNesY-Qh9L5PzVc70lIWaWs8-efjFv1zsCAAAFn1IAAAAEaAEHmQLgvaillQr2xrpS6FfRVqIEoexKaA15LYwSuJKFe9vi5MmyoDFXP77zXssV_kk7fe3TIXGutXHOs1GO7LLOT0QJEKPBq35xrpavli4Ll_-TnZSr1pJCJ7KgyqwoOEGfh9eDb6_RnwH46fBkytrdLZ_QZC1WGr6ZXm-Zzlm4_T1zNMjCWaC0zFA1YA0VBvWsnA0HPjEQOCm3B7OEv7KQ4Ywu6vQbhjpuLgc8JX1cqsBmTBZeGy3MNSilSFe7lHf8mlHAVz7iOCHND2ECSyBqG7NP9VBLrXens64FczKdj9rTwofJ2y5KwG3S2djbVxnzLoTrbeKlg0iNIbU93INSQTr_I0r7qfKKQ3cK3aR7sZR9QCjySr4ABZChflZ8tUtWkm4zj5WQmDsFPjy8zEboVuVTwjoO04duAvNNRE_GrugO2f8Ld4cAe1MUdqhW3La_FxQvh4fp2A78KxoLbTrUEs3EDiH-rj-HUgI8sW79ASBRgeMo7X44WSveqs_aETG3G1i-s1lWzx2PgQh5uaIOvlZcq1hA5aD6bZXQ7TSrXI9s2EmDfhpOfqL5-lWEktqZAtgyBku4NxV_0BwuGPa8UhNCO16xZ7wMT8AVwqPGZBvbl-MvFOfqYtheydb2XoEqfBP6c7nAPk4B__fpe_Ip2VGaPBTSDtLxDhPK2V5fK9Q9r6-HpmFpvPz6FHeA76I14c1R4pnd74SKK-51CaaI8Durg93DrdCCQ6v5JN6hgiufpXy3qbTCxSoqq0a1iS1nPAljbnvfffMavn7eeveQaAbkGQ01fFU6nq44hgZakxoLqDJ5hIFVJ-9eq_eGmWNHhn5FDo4pJ3X0KmtbLDJe_muv747PCiWfJtiPXMT4pFsZrUOkojfXfAg2FeEj8q3dolmA9trUa_q4uukNb5jEiuitW44kD17kcHc_eSGC6FeloE_WiScdBFU8Y-EuHcdBHPElsUICwRundxqD2o0xwLrDxQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
17632058214988633165
s0.2mdn.net/simgad/ Frame ACD4 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/17632058214988633165
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dead1f4e72e8cf849bdac46b95a197af4af11ed48877c2db53f38c3b7f43e545
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:42:29 GMT
x-content-type-options
nosniff
age
558139
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37712
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 19:19:13 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 08:42:29 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame ACD4 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:48 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame ACD4 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
5696
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame ACD4 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv6YAdTi0CbFSlayNMqul_bUeHh3CFl8xdE7LLdpVi1AbI0_JycHc8xMO8cfQD4liQ13qApA6Gi6hjauBgB-TyWUK7M6CfWlboxSBhT2wxjNHbCGQXXV8VQ6cGAWYPlCdZn6PDDfET6j4iW-zm0bFH8smskWbS8eIXOZR_0i4-meYr4xAJ3KyN1cdmhe0E&sai=AMfl-YSwa5NyJTR7gL-52ASc9tmVyDeoPRDsfh8uSxB4JMtgflT_H10jgCbM68FoUf-5sV20XdXTZa34uvckPjORiTq4SbEW_isygoO95w&sig=Cg0ArKJSzKS135BUOV7xEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230615.17986&arae=0&ftch=1&adurl=
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:48 GMT
dvtp_src.js
cdn.doubleverify.com/ Frame ACD4 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:48 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 14:39:49 GMT
Server
UploadServer
ETag
"6bbda2156609c9b24e1e0e365f01b513"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3374
Expires
Sun, 18 Jun 2023 14:55:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame ACD4 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:59:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42321
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 07:59:27 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame 7CAA 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=bdaakmyj&e=1918623590599
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46997
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:48 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291031
X-Served-By
cache-lga13626-LGA, cache-yul12833-YUL
X-Timer
S1687290288.357779,VS0,VE0
rd_log
nym1-ib.adnxs.com/ Frame ACD4 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKJEPBMCQgAAAMA1gAFAQirg8ikBhCLl7rC2q7Z4wQY1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjFpQWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFycDNZcHdqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMk5ESXg0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGbFRLUUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhETGdHQ2cuLpoCxQEhSFNPdl9nOv0CLExtcmx3RWdBQ2dBTQXBCQF8T2dsT1dVMHlPalkwTWpGQTZVTkpOank5VXBZaDlUOVIJJgEBBEJaAQYJATRCaEtWeVB3dlVvekQ5cAkUAQEEQngBBgkBYUlUSUJId2loeXlVUUJSZ0JJZ05EUVVRcBlgODh4UW1EbDBDTGJ5VC1KQRGY8F5QQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS_yAhEKBkFEVl9JRBIHNTUyMTA2OPICEgoGQ1BHX0lEEggyMTA4OTM2NvICEgoFQ1BfSUQSCZVGEPICDQoIAT4YRlJFURIBMAUQHFJFTV9VU0VSBRAADAkgGENPREUSAPIBDwhDUEcVDxALCgdDUBUOFBAKBUlPXwGJADiJ0ADyASEESU8VITgTCg9DVVNUT01fTU9ERUwBKxQA8gIaChYyFgAcTEVBRl9OQU0FcQgeCho2HQAIQVNUAT4QSUZJRUQBPhwVCghTUExJVAFNAAkV2fCwgAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgD5hXgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMTQ5LjU2LjE1My4xODeoBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA0gQPMTI5MTcjTllNMjo2NDIx2gQCCAHgBAHwBLyW180BiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkABQzAAADYBQHgBQHwBajgRvoFBAgAEACQBgCYBgCiBg8xMDI2NCNOWU0yOjUyOTW4BgDBBgk2LPA_0AaeqwLaBhYKEAkSGQFgEAAYAOAGAfIGhwEIwvZOEoABR2hTWlVsb0Gk4ERBQWtDQlFFSTBQTDNCeEMtMWJvQ0dPeUVsd01nQnlnQVFMQzB1Z2RJdjdXNkIxRHBRMWl2S1hFQQE9BQEMSGdBZ632BQEASc02LEpvQkFnZ0FxQUVBcy4gAHxBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHxaUF0gcNCRG5AbcI2gcGIQFwGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=c91df16f45fbd386b33e7cfc74e402888458a722&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dbdaakmyj%26e%3D1918623590599,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dbdaakmyj%26e%3D1918623590599&
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:48 GMT
AN-X-Request-Uuid
d18a439e-beb9-4c15-acff-36eea180f0b8
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
async_usersync
ib.adnxs.com/ Frame B30B 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:48 GMT
AN-X-Request-Uuid
ae074059-d37c-473c-84de-82ab3f5c0ade
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 0A5D 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
542
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=2qk8mk;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P697ub0AH...
ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/ Frame D6BE 		65 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=2qk8mk;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P697ub0AHMRP1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAjSf-8AAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IyMqAQjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNTdA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjU3%2Fbn%3D90699%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=169;prcl=s
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v96.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.64.70 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s30-in-f6.1e100.net
Software
cafe /
Resource Hash
0a1f6c413343d731fab211dffb1dbae0a1a52cab4f8c7b2ae5430b50103bae04
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
29933
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
PugMaster
image6.pubmatic.com/AdServer/ Frame 3692 		4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=14638061&p=156383&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
7dc8c3165af4b63e271bbdf28e2210367805c1dfee8880f4c9c038e16cd57dfd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:47 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
truncated
/ Frame 6E27 		207 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
22cfe8b4747da702aee268f347c579216ffc2e96a4cf4ced6b5f7388d99c5841

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
analytics.js
www.google-analytics.com/ 		51 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::200e Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 20 Jun 2023 17:56:36 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
6492
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Tue, 20 Jun 2023 19:56:36 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 12CA 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
542
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame ACD4 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv6YAdTi0CbFSlayNMqul_bUeHh3CFl8xdE7LLdpVi1AbI0_JycHc8xMO8cfQD4liQ13qApA6Gi6hjauBgB-TyWUK7M6CfWlboxSBhT2wxjNHbCGQXXV8VQ6cGAWYPlCdZn6PDDfET6j4iW-zm0bFH8smskWbS8eIXOZR_0i4-meYr4xAJ3KyN1cdmhe0E&sai=AMfl-YSwa5NyJTR7gL-52ASc9tmVyDeoPRDsfh8uSxB4JMtgflT_H10jgCbM68FoUf-5sV20XdXTZa34uvckPjORiTq4SbEW_isygoO95w&sig=Cg0ArKJSzKS135BUOV7xEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=104&vt=11&dtpt=102&dett=2&cstd=0&cisv=r20230615.17986&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:48 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame C702
Redirect Chain
  • https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e5c920de-0fa2-11ee-876c-8dbcb6804b27
42 B
341 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e5c920de-0fa2-11ee-876c-8dbcb6804b27
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, proxy-revalidate
content-length
0
content-type
image/gif
date
Tue, 20 Jun 2023 19:44:48 GMT
expires
Thu, 23 Sep 2004 17:42:04 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=e5c920de-0fa2-11ee-876c-8dbcb6804b27
p3p
CP="NOI OTC OTP OUR NOR"
pragma
no-cache
server
Cowboy
x-realserver-nx
lga-delivery-8
Pug
simage2.pubmatic.com/AdServer/ Frame A254
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
42 B
95 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 17:55:02 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

cache-control
no-cache
content-length
0
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:47 GMT
expires
Tue, 20 Jun 2023 00:00:00 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma
no-cache
server
Kestrel
server-processing-duration-in-ticks
1125266
strict-transport-security
max-age=31536000; preload;
x-errorlevel
0
Pug
simage2.pubmatic.com/AdServer/ Frame 0EF2
Redirect Chain
  • https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
42 B
379 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:47 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Connection
keep-alive
Content-Length
188
Content-Type
text/html; charset=utf-8
Date
Tue, 20 Jun 2023 19:44:48 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=ruPoSpZIUIJ7GLwbam2kAZU4mbs&gdpr=0&gdpr_consent=
Pug
simage2.pubmatic.com/AdServer/ Frame 84AF
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=PUBMATIC&rurl=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:_wfivefivec_&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:09wHc8i51QbHhu5&gdpr=0&gdpr_consent=
42 B
219 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:09wHc8i51QbHhu5&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:48 GMT
Expires
Fri, 01 Jan 1990 00:00:00 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzQmdGw9MTI5NjAw&piggybackCookie=uid:09wHc8i51QbHhu5&gdpr=0&gdpr_consent=
Pragma
no-cache
Server
PingMatch/v2.0.30-780-gdfb6b2e#rel-ec2-master i-080ca4cd6cc01412e@us-east-1b@dxedge-app-us-east-1-prod-asg
Strict-Transport-Security
max-age=2592000; includeSubDomains
pbmtc.gif
beacon.lynx.cognitivlabs.com/ Frame 2233
Redirect Chain
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MSZjb2RlPTM0MzkmdGw9MTI5NjAw&piggybackCookie=cde16cd9-d9ed-4cdd-9d7f-cd6930766499&r=https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=$...
  • https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=479CC621-B2E0-490D-8915-42055EBBC0EB
42 B
507 B 		Document
General
Check archive.org
Download Go to
Full URL
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=479CC621-B2E0-490D-8915-42055EBBC0EB
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.230.233.1 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-230-233-1.compute-1.amazonaws.com
Software
Kestrel /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
42
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:48 GMT
Server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
date
Tue, 20 Jun 2023 17:49:46 GMT
location
https://beacon.lynx.cognitivlabs.com/pbmtc.gif?puid=479CC621-B2E0-490D-8915-42055EBBC0EB
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
Pug
simage2.pubmatic.com/AdServer/ Frame 12D6
Redirect Chain
  • https://ums.acuityplatform.com/tum?umid=6
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501305684
42 B
209 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501305684
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Access-Control-Allow-Origin
*
Content-Length
0
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=792501305684
Pug
simage2.pubmatic.com/AdServer/ Frame 9F9B
Redirect Chain
  • https://ad.mrtnsvr.com/sync/pubmatic?gdpr=0&gdpr_consent=
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw%26piggybackCookie%3D%23PM_USER_ID%26gdpr...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
42 B
285 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:48 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTgmdGw9MTI5NjAw&piggybackCookie=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
i.match
s.tribalfusion.com/z/ Frame 566C
Redirect Chain
  • https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
  • https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...
43 B
415 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache private
cf-cache-status
DYNAMIC
cf-ray
7da682303fc03400-YUL
content-length
43
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
x-function
302

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache private
cf-cache-status
DYNAMIC
cf-ray
7da6822f7e333400-YUL
content-type
text/html
date
Tue, 20 Jun 2023 19:44:48 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p
CP="NOI DEVo TAIa OUR BUS"
pragma
no-cache
server
cloudflare
x-function
206
x-reuse-index
499
Pug
simage2.pubmatic.com/AdServer/ Frame CB30
Redirect Chain
  • https://sync.1rx.io/usersync2/pubmatic&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2310082572
  • https://sync.1rx.io/usersync/tradedesk/db51a350-c421-4780-94b8-db6155d007ec
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA%...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
42 B
253 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:48 GMT
ETag
RX0582ffcc029a4b6a9d8acee11ea1f0b8005
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDMmdGw9NDMyMDA=&piggybackCookie=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server
Tengine
Transfer-Encoding
chunked
Pug
simage2.pubmatic.com/AdServer/ Frame 7E3D
Redirect Chain
  • https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
  • https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
0
74 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 17:52:56 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:48 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server
_
Pug
image2.pubmatic.com/AdServer/ Frame 4CD8
Redirect Chain
  • https://gocm.c.appier.net/pubmatic
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=EBt_tnDEDsSGBBPtsQGSZA
42 B
200 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=EBt_tnDEDsSGBBPtsQGSZA
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

accept-ch
Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
cache-control
no-store
content-length
153
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:49 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyMDImdGw9MTI5NjAw&piggybackCookie=EBt_tnDEDsSGBBPtsQGSZA
p3p
CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
nginx
cm
ipac.ctnsnet.com/int/ Frame 7ED0 		43 B
370 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
173.193.186.35.bc.googleusercontent.com
Software
Apache-Coyote/1.1 /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
43
content-type
image/gif
date
Tue, 20 Jun 2023 19:44:48 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
CP="NOI DSP COR NID CUR OUR NOR"
pragma
no-cache
server
Apache-Coyote/1.1
via
1.1 google
Pug
image2.pubmatic.com/AdServer/ Frame B152
Redirect Chain
  • https://mweb.ck.inmobi.com/sync/15?redirect=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA%3D%3D%26piggybackCookie%3D%24DSP_CKID
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=d93de280-8ab8-456d-b53b-9ab646fa4468
1 B
53 B 		Document
General
Check archive.org
Download Go to
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=d93de280-8ab8-456d-b53b-9ab646fa4468
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
1
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:48 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzQzNSZ0bD00MzIwMA==&piggybackCookie=d93de280-8ab8-456d-b53b-9ab646fa4468
strict-transport-security
max-age=15724800; includeSubDomains
pub
matching.truffle.bid/sync/ Frame FF63 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://matching.truffle.bid/sync/pub?sid=161&suid=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NDQmdGw9MjAxNjA=&piggybackCookie=$UID
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
162.55.120.196 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.196.120.55.162.clients.your-server.de
Software
nginx/1.23.3 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:48 GMT
Server
nginx/1.23.3
Strict-Transport-Security
max-age=15768000
cookiesync
core.iprom.net/ Frame 6D4C 		43 B
279 B 		Document
General
Check archive.org
Download Go to
Full URL
https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
close
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:49 GMT
Vary
Accept-Encoding
X-adserver-worker
komodo-93826535a160@version_1.556v2
X-core-time
0ms
X-server-arch
v2
Pug
simage2.pubmatic.com/AdServer/ Frame CC5E
Redirect Chain
  • https://px.owneriq.net/epm?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=$UID
  • https://px.owneriq.net/ecc?redir=https%3a%2f%2fsimage2.pubmatic.com%2fAdServer%2fPug%3fvcode%3dbz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw%26piggybackCookie%3dQ7405766881343085934&uid=Q740576688134308...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766881343085934
42 B
95 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766881343085934
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
42
content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:47 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

Cache-Control
max-age=43398
Connection
keep-alive
Content-Length
154
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:49 GMT
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNzMmdGw9MTI5NjAw&piggybackCookie=Q7405766881343085934
P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server
Apache/2.4.6 (CentOS)
Vary
Accept-Encoding
X-Powered-By
PHP/7.3.33
Pug
simage2.pubmatic.com/AdServer/ Frame 6A2D
Redirect Chain
  • https://um.simpli.fi/pm_match?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:8B59A33699C741AFA2C7A091E574C7C9&gdpr=0&gdpr_consent=
1 B
53 B 		Document
General
Check archive.org
Download Go to
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:8B59A33699C741AFA2C7A091E574C7C9&gdpr=0&gdpr_consent=
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-store, no-cache, private
content-length
1
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx

Redirect headers

access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-length
142
content-type
text/html
date
Tue, 20 Jun 2023 19:44:48 GMT
expires
Mon, 19 Jun 2023 19:44:48 GMT
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjkzNiZ0bD00MzIwMA==&piggybackCookie=uid:8B59A33699C741AFA2C7A091E574C7C9&gdpr=0&gdpr_consent=
server
openresty
strict-transport-security
max-age=63072000; includeSubdomains; preload
x-content-type-options
nosniff
458249.gif
idsync.rlcdn.com/ Frame 3692
Redirect Chain
  • https://idsync.rlcdn.com/712188.gif?partner_uid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
  • https://pippio.com/api/sync?pid=5324&it=1&iv=92b7f04663d835edece4cb34207788586f982d0c9d178d6b1998e33b4119b735791426b5417dce21&_=2
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlA5MmI3ZjA0NjYzZDgzNWVkZWNlNGNiMzQyMDc3ODg1ODZmOTgyZDBjOWQxNzhkNmIxOTk4ZTMzYjQxMTliNzM1NzkxNDI2YjU...
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlA5MmI3ZjA0NjYzZDgzNWVkZWNlNGNiMzQyMDc3ODg1ODZmOTgyZDBjOWQxNzhkNmIxOTk4ZTMzYjQxMTliNzM1NzkxNDI2YjU0MTdkY2UyMRAAGgwIsIPIpAYSBAgCEABCAEoA&goog...
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
  • https://idsync.rlcdn.com/458249.gif?partner_uid=365f9e71-e58f-498c-87fb-3ce6d43b34a3
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/458249.gif?partner_uid=365f9e71-e58f-498c-87fb-3ce6d43b34a3
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
via
1.1 google
content-type
image/gif
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/458249.gif?partner_uid=365f9e71-e58f-498c-87fb-3ce6d43b34a3
date
Tue, 20 Jun 2023 19:44:49 GMT
via
1.1 google
x-samesite
secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111
content-type
text/html; charset=utf-8
gdpr_consent=
bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=479CC621-B2E0-490D-8915-42055EBBC0EB/gdpr=0/ Frame 3692 		49 B
263 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bcp.crwdcntrl.net/map/c=14701/tp=MTAI/tpid=479CC621-B2E0-490D-8915-42055EBBC0EB/gdpr=0/gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.123.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-123-193.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.11.3
content-length
49
expires
0
receive
pixel.tapad.com/idsync/ex/ Frame 3692 		95 B
123 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive?partner_id=3203&partner_device_id=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
strict-transport-security
max-age=31536000
via
1.1 google
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-type
image/png
access-control-allow-origin
*
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95
/
bpi.rtactivate.com/tag/ Frame 3692 		43 B
109 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bpi.rtactivate.com/tag/?id=20909&user_id=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.203.16.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-203-16-231.compute-1.amazonaws.com
Software
awselb/2.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
server
awselb/2.0
content-length
43
content-type
image/gif
Pug
simage2.pubmatic.com/AdServer/ Frame 3692
Redirect Chain
  • https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1235390588561432912
42 B
243 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1235390588561432912
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:48 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1235390588561432912
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
Pug
simage2.pubmatic.com/AdServer/ Frame 3692
Redirect Chain
  • https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3321274862842215126
42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3321274862842215126
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:47 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date
Tue, 20 Jun 2023 19:44:48 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 565.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
4f422c19-44ff-4c97-bb9e-cc075da261c5
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=3321274862842215126
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 3692
Redirect Chain
  • https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
  • https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:8e573587-b904-4733-a2c4-ff0a85ac28aa&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
42 B
95 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:8e573587-b904-4733-a2c4-ff0a85ac28aa&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Protocol
H2
Server
8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Tue, 20 Jun 2023 19:44:50 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:8e573587-b904-4733-a2c4-ff0a85ac28aa&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date
Tue, 20 Jun 2023 19:44:49 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=3000
Content-Length
0
P3P
policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"
async_usersync
ib.adnxs.com/ Frame 7CAA 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:48 GMT
AN-X-Request-Uuid
82089d0d-35dd-419a-a4a0-6287b8772f60
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
17632058214988633165
s0.2mdn.net/simgad/ Frame D6BE 		37 KB
37 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.2mdn.net/simgad/17632058214988633165
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=2qk8mk;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P697ub0AHMRP1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAjSf-8AAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IyMqAQjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNTdA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjU3%2Fbn%3D90699%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=169;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:824::2006 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dead1f4e72e8cf849bdac46b95a197af4af11ed48877c2db53f38c3b7f43e545
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 14 Jun 2023 08:42:29 GMT
x-content-type-options
nosniff
age
558139
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37712
x-xss-protection
0
last-modified
Wed, 07 Jun 2023 19:19:13 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 13 Jun 2024 08:42:29 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D6BE 		178 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=2qk8mk;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P697ub0AHMRP1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAjSf-8AAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IyMqAQjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNTdA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjU3%2Fbn%3D90699%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=169;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:823::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57029
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1686742752845198"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 20 Jun 2023 19:44:48 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/ Frame D6BE 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230615/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=2qk8mk;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P697ub0AHMRP1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAjSf-8AAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IyMqAQjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNTdA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjU3%2Fbn%3D90699%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=169;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 18:09:52 GMT
content-encoding
br
x-content-type-options
nosniff
age
5696
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Tue, 04 Jul 2023 18:09:52 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame D6BE 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvRNFVkfO9x-BgvVIGlh2EDWeuPbF-cXphVEB5iSewhJxSk4Fx57WzeCo2RYHT4Jv0B-PtmvN3KYBHb2L6oRxkBTJdA7M6ArOnHq-GoSQLghr08abUOfxqGEEtPI-0Xq2vyCf9LrNtw5iLnJRJ3cGI-6AYbGEqj0B6BSB6Tozf-vAU&sai=AMfl-YRKuK3PjnL68xJ2h4T7tq5op-3CiIIwYNNc4s-N2IjHEJhXCSw2QUyx1Y7kkh6hFuUF4m7JE0FjAeqdSEDRJmGbpCLQ_gV4eJjeOQ&sig=Cg0ArKJSzIOYjG_j55EQEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20230615.52894&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=2qk8mk;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P697ub0AHMRP1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAjSf-8AAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IyMqAQjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNTdA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjU3%2Fbn%3D90699%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=169;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:48 GMT
dvtp_src.js
cdn.doubleverify.com/ Frame D6BE 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=2qk8mk;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P697ub0AHMRP1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAjSf-8AAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IyMqAQjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNTdA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjU3%2Fbn%3D90699%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=169;prcl=s
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:48 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 14:39:49 GMT
Server
UploadServer
ETag
"6bbda2156609c9b24e1e0e365f01b513"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3374
Expires
Sun, 18 Jun 2023 14:55:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame D6BE 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=2qk8mk;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P697ub0AHMRP1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAjSf-8AAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IyMqAQjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNTdA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjU3%2Fbn%3D90699%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=169;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 07:59:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
42321
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 07:59:27 GMT
async_usersync.html
acdn.adnxs.com/dmp/ Frame 814F 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=cbyfcuv&e=1918623590599
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46998
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:48 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291704
X-Served-By
cache-lga13626-LGA, cache-yul12820-YUL
X-Timer
S1687290289.622454,VS0,VE0
rd_log
nym1-ib.adnxs.com/ Frame D6BE 		0
933 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKJEPBMCQgAAAMA1gAFAQirg8ikBhCv9-Xti4CH4k8Y1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjLxAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFuNTMxb1FqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMU1qVTM0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGaVNtUUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhATGdHQ2cuLpoCxQEhSXlNcUE-_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qVXlOVGRBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZjwXlBBX9gCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL_ICEQoGQURWX0lEEgc1NTIxMDY48gISCgZDUEdfSUQSCDIxMDg5MzY28gISCgVDUF9JRBIJlUYQ8gINCggBPhhGUkVREgEwBRAcUkVNX1VTRVIFEAAMCSAYQ09ERRIA8gEPCENQRxUPEAsKB0NQFQ4UEAoFSU9fAYkAOInQAPIBIQRJTxUhOBMKD0NVU1RPTV9NT0RFTAErFADyAhoKFjIWABxMRUFGX05BTQVxCB4KGjYdAAhBU1QBPhBJRklFRAE-HBUKCFNQTElUAU0ACRXZ8LCAAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjUyNTfaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAFDMAAANgFAeAFAfAFqOBG-gUECAAQAJAGAJgGAKIGDzEwMjY0I05ZTTI6NTAwNLgGAMEGCTYs8D_QBp6rAtoGFgoQCRIZAWAQABgA4AYB8gaHAQjC9k4SgAE5UlBRUzFvQaTgREFBa0NCUUVJMFBMM0J4Qy0xYm9DR095RWx3TWdCeWdBUUxDMHVnZEl2N1c2QjFEcFExaU1KM0VBAT0FAQxIZ0FnrfYFAQBJzTYsSm9CQWdnQXFBRUFzLiAAfEEuLoAHAYgHAKAHAboHCCoEMS0tLUAByAfLxAXSBw0JEbkBtwjaBwYhAXAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=e1c808f21f3eb6de3b4198233b4edd07059899e8&bdref=https%3A%2F%2Fwww.mercurynews.com%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwww.mercurynews.com%2F,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dcbyfcuv%26e%3D1918623590599,https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dcbyfcuv%26e%3D1918623590599&
Requested by
Host: sopalk.com
URL: https://sopalk.com/r/p.html?f=cbyfcuv&e=1918623590599
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:48 GMT
AN-X-Request-Uuid
d6800f9a-b661-49c8-bc3f-7e6e8b5abc65
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 6BCE 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165953
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:48 GMT
expires
Thu, 22 Jun 2023 17:50:41 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 83D8 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46998
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:48 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291705
X-Served-By
cache-lga13626-LGA, cache-yul12820-YUL
X-Timer
S1687290289.634855,VS0,VE0
usync.html
eus.rubiconproject.com/ Frame 4F58 		281 B
401 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
233
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:48 GMT
etag
"40010-119-5ec73a0a33d00"
last-modified
Wed, 02 Nov 2022 02:30:44 GMT
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
/
csync.smilewanted.com/ Frame AFD3 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682300e9c6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:48 GMT
server
cloudflare
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 9134
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%4...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=fbc3b4d9-a11b-4371-a88d-35e24043ca77&gdpr=0&gdpr_consent=
43 B
571 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=fbc3b4d9-a11b-4371-a88d-35e24043ca77&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=fbc3b4d9-a11b-4371-a88d-35e24043ca77&gdpr=0&gdpr_consent=
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1034317
content-length
0
expires
Tue, 20 Jun 2023 00:00:00 GMT
redir
rtb-csync.smartadserver.com/ Frame 9134
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/sas?gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEDUk7JJAMAACROtOIu9g&gdpr=0
43 B
531 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEDUk7JJAMAACROtOIu9g&gdpr=0
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAEDUk7JJAMAACROtOIu9g&gdpr=0
Date
Tue, 20 Jun 2023 19:44:48 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
/
sync.richaudience.com/a6c163b098d05a413cd1682e26fae172/ Frame 9134
Redirect Chain
  • https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=111&partneruserid=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&redirurl=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F102%2F8%2F2.gif%3Fpuid%3DSMART_...
  • https://id5-sync.com/c/102/102/8/2.gif?puid=4777538607685951564&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
  • https://cookie-matching.mediarithmics.com/v1/get_user_agent_id?dom_token=id517&gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY
  • https://cookie-matching.mediarithmics.com/v1/get_or_create?gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&domid=1033
  • https://cm.g.doubleclick.net/pixel?google_nid=medr&google_cm&key=GOO&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&gdpr_consent=&gdpr=0&action=GET_I...
  • https://cookie-matching.mediarithmics.com/input?key=GOO&key=GOO&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY&gdpr_consent=&gdpr=0&action=GET_ID&opi...
  • https://ib.adnxs.com/getuid?https://cookie-matching.mediarithmics.com/input?key=APX&apx_uid=$UID&opid=apx&ops=&utidl=tech:goo:CAESEJv49rfB51JSFqaB7F22XtY&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0Rv...
  • https://cookie-matching.mediarithmics.com/input?key=APX&apx_uid=3321274862842215126&opid=apx&ops=&utidl=tech:goo:CAESEJv49rfB51JSFqaB7F22XtY&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0a...
  • https://id5-sync.com/qp/18.gif?puid=vec%3A38886178730&gdpr=0&gdpr_consent=&sd=Y2FzY2FkZXNSZW1haW5pbmc9NyZjYXNjYWRlc0RvbmU9MyZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F104%2F6%2F4.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/102/104/6/4.gif?puid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=
  • https://cookie-matching.mediarithmics.com/v1/get_user_agent_id?dom_token=id517&gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY
  • https://id5-sync.com/qp/18.gif?puid=vec%3A38886178730&gdpr_consent=&gdpr=0&sd=Y2FzY2FkZXNSZW1haW5pbmc9NSZjYXNjYWRlc0RvbmU9NSZpbml0aWF0aW5nUGFydG5lcj0xMDImZm9ybWF0PWdpZiY
  • https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
  • https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AAEDUk7JJAMAACROtOIu9g
  • https://x.bidswitch.net/check_uuid/https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F104%2F3%2F7.gif%3Fpuid%3D%24%7BBSW_UUID%7D%26gdpr%3D0%26gdpr_consent%3D?gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/102/104/3/7.gif?puid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=
  • https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F102%2F10%2F2%2F8.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
  • https://id5-sync.com/c/102/10/2/8.gif?puid=1235390588561432912&gdpr=0&gdpr_consent=
  • https://sync.richaudience.com/a6c163b098d05a413cd1682e26fae172/?uid=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A
95 B
389 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.richaudience.com/a6c163b098d05a413cd1682e26fae172/?uid=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A
Protocol
H2
Server
138.201.8.249 Ergolding, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.249.8.201.138.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:44:50 GMT
server
nginx/1.14.1
x-powered-by
PHP/8.2.4
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Redirect headers

location
https://sync.richaudience.com/a6c163b098d05a413cd1682e26fae172/?uid=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A
date
Tue, 20 Jun 2023 19:44:51 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding
chunked
p3p
CP="CAO PSA OUR"
pixel
cm.g.doubleclick.net/ Frame 9134
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent=
Protocol
H3
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
v1
match.sharethrough.com/sync/ Frame 9134
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=139&partneruserid=0&redirurl=https%3A%2F%2Fmatch.sharethrough.com%2Fsync%2Fv1%3Fsource_id%3D98KUz37ype9D3X2sf9ovgeTt%26source_user_id%3DS...
  • https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4777538607685951564&gdpr=0&gdpr_consent=
68 B
607 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4777538607685951564&gdpr=0&gdpr_consent=
Protocol
H2
Server
18.215.8.84 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-215-8-84.compute-1.amazonaws.com
Software
/
Resource Hash
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
cache-control
no-cache
content-length
68
content-type
image/png

Redirect headers

location
https://match.sharethrough.com/sync/v1?source_id=98KUz37ype9D3X2sf9ovgeTt&source_user_id=4777538607685951564&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:47 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
dv-measurements3941.js
cdn.doubleverify.com/ Frame 8B22 		536 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-measurements3941.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:48 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 10:24:03 GMT
Server
UploadServer
ETag
"245897220fbd1a0dfa41e714a5e3acf6"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=946080900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103853
Expires
Mon, 17 Jun 2024 10:24:07 GMT
vevent
nym1-ib.adnxs.com/ Frame ACD4 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQirg8ikBhCLl7rC2q7Z4wQY1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjFpQWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFycDNZcHdqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMk5ESXg0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGbFRLUUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhMTGdHQ2cuLpoCxQEhSFNPdl9namcy_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qWTBNakZBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjY0MjHaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1Mjk1uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABR2hTWlVsb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpdktYRUFBQUFBQUFBQUFIZ0FnUUVBQUFBKd0ASa0fNEpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAfFpQXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=7dcbc8bc793b98de507c2b44c191dd0a3197ca97&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=1615154911199896023&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:48 GMT
AN-X-Request-Uuid
4bee037d-fc37-40ce-af86-8507b87e1bcb
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
drop_cookie_sw.php
csync.smilewanted.com/ Frame 137B 		0
345 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68231e8e66372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame A04B 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
49964
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 05:52:04 GMT
expires
Wed, 19 Jun 2024 05:52:04 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
usync.html
eus.rubiconproject.com/ Frame CF8B 		281 B
401 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
233
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:48 GMT
etag
"40010-119-5ec73a0a33d00"
last-modified
Wed, 02 Nov 2022 02:30:44 GMT
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame F94E 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46999
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:48 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291706
X-Served-By
cache-lga13626-LGA, cache-yul12820-YUL
X-Timer
S1687290289.938187,VS0,VE0
/
csync.smilewanted.com/ Frame 1D7F 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68231f8f46372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 96DA 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165953
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:48 GMT
expires
Thu, 22 Jun 2023 17:50:41 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame E61A
Redirect Chain
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
43 B
666 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
date
Tue, 20 Jun 2023 19:44:48 GMT
content-length
0
/
rtb-csync.smartadserver.com/redir/ Frame E61A
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?&rd=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D91%26partneruserid%3D%23PM_USER_ID%26gdpr%3DPM_GDPR%26gdpr_conse...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
43 B
662 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
date
Tue, 20 Jun 2023 19:44:48 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
/
rtb-csync.smartadserver.com/redir/ Frame E61A
Redirect Chain
  • https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent=
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F2075%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=759507639
  • https://sync.1rx.io/usersync3/mediamathtest/2075/5f956492-01a9-4900-b96e-6cf0342c9990?zcc=0&sspret=1
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-0582ffcc-0...
  • https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
43 B
764 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:49 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Date
Tue, 20 Jun 2023 19:44:49 GMT
Server
Tengine
ETag
RX0582ffcc029a4b6a9d8acee11ea1f0b8005
Transfer-Encoding
chunked
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Content-Type
text/html
Connection
keep-alive
/
rtb-csync.smartadserver.com/redir/ Frame E61A
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=smart-adserver&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
43 B
662 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=75&issi=1&partneruserid=db51a350-c421-4780-94b8-db6155d007ec&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
299
/
rtb-csync.smartadserver.com/redir/ Frame E61A
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=39&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D25%26partneruserid%3D%5BMM_UUID%5D&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
43 B
662 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:48 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Date
Tue, 20 Jun 2023 19:44:48 GMT
Server
MT3 1031 59fd23a master iad iad-pixel-x24 config_version:"1969"
Content-Type
image/gif
Access-Control-Allow-Origin
*
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=25&partneruserid=5f956492-01a9-4900-b96e-6cf0342c9990&gdpr=0&gdpr_consent=
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
0
Expires
Tue, 20 Jun 2023 19:44:47 GMT
usync.js
eus.rubiconproject.com/ Frame 4F58 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:48 GMT
content-encoding
gzip
last-modified
Tue, 20 Jun 2023 08:41:09 GMT
server
Apache/2.2.15 (CentOS)
x-powered-by
PHP/5.3.3
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control
max-age=46557
content-length
10113
expires
Wed, 21 Jun 2023 08:40:45 GMT
G2VgbPZHuyVpOjRtQ-i3ojE3
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame 7E15
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
0
391 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682336a926372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:49 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
X-Sovrn-Pod
ad_ap4ewr1
match
ice.360yield.com/ Frame 5BD9
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://id5-sync.com/s/286/9.gif?puid=397b5886-1416-4626-ba56-1zz1687290289&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.richaudience.com%2Fa6c163b098d05a413cd1682e26fae172%2F%3Fuid%3D%7BID5UID%7D
  • https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F434%2F8%2F2.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
  • https://id5-sync.com/c/286/434/8/2.gif?puid=2c0f44d2-6a66-40d3-a3dc-600d11c96224&gdpr=0&gdpr_consent=
  • https://inmobi-match.dotomi.com/match/bounce/current?networkId=98193&version=1&gdpr=0&gdpr_consent=
  • https://inmobi-match.dotomi.com/match/bounce/current?DotomiTest=62a4a683ab1d145f&is_secure=true&networkId=98193&version=1&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/822.gif?puid=AAAMuMw_h2LY3QM08ejhAAAAAAA&expiration=1687376691&is_secure=true&gdpr_consent=&gdpr=0
  • https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F286%2F124%2F6%2F4.gif%3Fpuid%3D...
  • https://id5-sync.com/cq/286/124/6/4.gif?puid=92e9d51d-f58b-4a55-97b2-6ee67deb9268&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
  • https://match.prod.bidr.io/cookie-sync/id5?us_privacy=
  • https://id5-sync.com/k/155.gif?id5AccountNum=155&numCascadesAllowed=9&puid=AAEDUk7JJAMAACROtOIu9g
  • https://csync.loopme.me/?redirect=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F821%2F4%2F6.gif%3Fpuid%3D%7Bdevice_id%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/286/821/4/6.gif?puid=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr=0&gdpr_consent=
  • https://rtd-tm.everesttech.net/upi/pid/dm4ha19W?redir=https%3A%2F%2Fid5-sync.com%2Fc%2F286%2F136%2F3%2F7.gif%3Fpuid%3D%24%7BTM_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/286/136/3/7.gif?puid=ZJIBqAABSFKRcAAz&gdpr=0&gdpr_consent=
  • https://token.rubiconproject.com/token?pid=49266&puid={ID5UID}&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/285.gif?puid=LJ4P2KW9-15-LLQ7&gdpr=0
  • https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F286%2F916%2F1%2F9.gif%3Fpuid%3...
0
0
view
googleads4.g.doubleclick.net/pcs/ Frame D6BE 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvRNFVkfO9x-BgvVIGlh2EDWeuPbF-cXphVEB5iSewhJxSk4Fx57WzeCo2RYHT4Jv0B-PtmvN3KYBHb2L6oRxkBTJdA7M6ArOnHq-GoSQLghr08abUOfxqGEEtPI-0Xq2vyCf9LrNtw5iLnJRJ3cGI-6AYbGEqj0B6BSB6Tozf-vAU&sai=AMfl-YRKuK3PjnL68xJ2h4T7tq5op-3CiIIwYNNc4s-N2IjHEJhXCSw2QUyx1Y7kkh6hFuUF4m7JE0FjAeqdSEDRJmGbpCLQ_gV4eJjeOQ&sig=Cg0ArKJSzIOYjG_j55EQEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=533&vt=11&dtpt=532&dett=2&cstd=0&cisv=r20230615.52894&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1436013.3803589XANDRINVESTAPPNE/B29599255.364198308;dc_ver=96.284;sz=300x250;u_sd=1;gdpr=0;dc_adk=1241189742;ord=2qk8mk;click=https%3A%2F%2Fnym1-ib.adnxs.com%2Fclick%3Feyx96IL6dj84U5C74otxPwAAAIDC9fA_OFOQu-KLcT97LH3ogvp2P697ub0AHMRP1vokEeSJFy6rAZJkAAAAAO5vsAEYKAAAdTIAAAIAAAA8y7UZudUlAAAAAABVU0QARVVSACwB-gAmFwAAAAABAQUCAAAAANoAjSf-8AAAAAA.%2Fbcr%3DAAAAAAAA8D8%3D%2Fcnd%3D%2521IyMqAQjgh-IaELyW180BGLmrlwEgACgAMQAAAAAAAAAAOglOWU0yOjUyNTdA6UNJNjy9UpYh9T9RAAAAAAAAAABZAAAAAAAAAABhKVyPwvUozD9pAAAAAAAAAABxAAAAAAAAAAB4AIIBHwihyyUQBRgBIgNDQUQpNjy9UpYh9T8xQmDl0CLbyT-JAQAAAAAAAPA_%2Fcca%3DMTI5MTcjTllNMjo1MjU3%2Fbn%3D90699%2Fclickenc%3D;uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..;dc_rfl=2,https%3A%2F%2Fwww.mercurynews.com%2F$0;xdt=1;crlt=8hDmZ*3ZPC;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=169;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.176.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s37-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Tue, 20 Jun 2023 19:44:49 GMT
RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame DF46
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://sync.mathtag.com/sync/img?mt_exid=74&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fmediamathtest%2F2069.66%2F%5BMM_UUID%5D%3Fzcc%3D0%26sspret%3D1&rndcb=5989968298
  • https://sync.1rx.io/usersync3/mediamathtest/2069.66/5f956492-01a9-4900-b96e-6cf0342c9990?zcc=0&sspret=1
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-0582ffcc-029a-4b6a-9d8a-cee...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
0
389 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682344b876372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:49 GMT
ETag
RX0582ffcc029a4b6a9d8acee11ea1f0b8005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server
Tengine
Transfer-Encoding
chunked
usync.js
eus.rubiconproject.com/ Frame CF8B 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
content-encoding
gzip
last-modified
Tue, 20 Jun 2023 08:41:09 GMT
server
Apache/2.2.15 (CentOS)
x-powered-by
PHP/5.3.3
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control
max-age=46556
content-length
10113
expires
Wed, 21 Jun 2023 08:40:45 GMT
i
www.i.matheranalytics.com/ 		43 B
245 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.i.matheranalytics.com/i?e=pe&tv=js-3.0.165&tna=Mather&aid=v1&p=web&tz=Etc%2FUnknown&tzoff=0&lang=en-US&cs=UTF-8&navt=link&f_pdf=1&res=1600x1200&cd=24&cookie=1&f_jquery=1&f_es6=1&f_gears=2&tvltm=27&tvcfg=wp&f_privb=0&tid=bdab9433-c491-40cf-af6f-45c8fc3ecc51&pid=2d10aa57-19ef-4ec0-84a8-3899d30f307c&dtm=1687290289138&qnm=_matherq&visible=1&tabid=40005137-57dc-449b-98c4-09fff3481006&url=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&vp=1600x1200&ds=4000x10480&tofa=1687290279&vid=1&lvidt=1687290279&duid=1bfd33dc-1dec-4854-b026-244377afad71&fp=967226427&cid=ma23578&mrk=239876506&cx=eyJwZXJmIjp7InN0YXJ0IjoiMTY4NzI5MDI3NjU2NyIsInJlZGlyQ250IjoiMCIsIm5hdlR5cGUiOiJsaW5rIiwiaGVhcFUiOiI0NC43bWIiLCJoZWFwVCI6IjY0bWIiLCJmc3RQYWludCI6Ijc0MCIsImZldGNoUyI6IjM4IiwiZG9tYWluUyI6IjM5IiwiZG9tYWluRSI6IjQwIiwiY29ublMiOiI0MCIsImNvbm5FIjoiNzQiLCJzc2xTIjoiNTUiLCJyZXF1UyI6Ijc1IiwicmVzcFMiOiI5MSIsInJlc3BFIjoiMTIwIiwiZG9tTG9hZCI6Ijk1IiwiZG9tSW50ZXIiOiIxMDU4IiwiZG9tTG9hZFMiOiIxMDg5IiwiZG9tTG9hZEUiOiIxMTE4IiwiZG9tQ21wbHQiOiI3NzE5IiwibG9hZFMiOiI3NzE5IiwibG9hZEUiOiI3NzkwIn19
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.81.74 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-81-74.compute-1.amazonaws.com
Software
/
Resource Hash
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

P3P
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
Date
Tue, 20 Jun 2023 19:44:49 GMT
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 89C5
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}&crf=1
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
0
469 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682358c8d6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
event.png
tpsc-ue1.doubleverify.com/ Frame 069C 		0
234 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tpsc-ue1.doubleverify.com/event.png?impid=7d284551a8ee4892a6d963a0a6f7115f&flavor=0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&ee_dp_adlst=2&vdur=153&eoid=14&msrjs=3941&sdf=67108870&vit=2&isvelg=1&rmi=16&tltms=127&tetms=15&msltms=40&vltms=153&sei=290&vetms=462&tuviims=154&tuviems=769&engms=1&engisel=1&dvp_dtcov=4&msrcanlm=394&msrcannum=4&ee_dp_tmads=2888&ismms=110&isumms=109&nvr=6&elmtp=3&isbxdms=2884&b0=100&b11=2790&adhgt=250&adwdth=300&norwdth=300&norhgt=250&vsos=4&dvp_vsosnmr=16&lftb=2890&sftb=2890&msrdp=2&naral=2&vct=512&vphgt=1200&vpwdth=1600&chgt=250&cwdth=300&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=1281&isuiabvms=1281&ispmxpms=1281&engalms=108&engscrlms=262&dvp_pageEng=true&dvp_dpr=1&vstsz=756&ee_dp_cvcmeeid=1&metp=1&meeid=1&ttfurm=3779&cbust=1687290289151333
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:49 GMT
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Expires
06/19/2023 19:44:49
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 38BD
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
616 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682344b866372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:49 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
ca
choices.trustarc.com/ Frame 582C 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=380229093&js=pmw1&base=te-clr1-cb8138fc-9765-4083-b0e0-7c6301a44fe3
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=380229093&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
f8984d530835313b7a668c60bc371514f44716daa6675dbf1d401e36c1ad3153
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2329
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
IMcmsTYNzqr4AHS2z8EBv_wdGj9b-d6bnnJTWDUMEdYwJ25XptwZwQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 582C 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=380229093&js=pmw2
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?sz=300x250&c=380229093&cid=0&aid=sojern02_d&pid=sojern01&js=pmw0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
kN0uTQeKNJkWIfHp3ykemLrCRRM_FGztbf2dUKfL5LuHaJgTTpZ_qw==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame 582C 		43 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=11cd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
Cmtq16_S9DAN8YKTbDsMnAgsC7zQl-Fe9vPzuX9kjZB68vu93k4P0w==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 582C 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=25623876&js=st_1&sz=300x250&c=te-51a2
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=25623876&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
54fbb71b64403c94cb8b42d2ed2db491bb639db63896bc81f12370e535843774
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
2245
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
kAPx90FTu4m8IarzBEGI5-IQaAgVwyvKzLKonsA6Hc2JZFJ-c7OawQ==
expires
Mon, 26 Jul 1997 05:00:00 GMT
ca
choices.trustarc.com/ Frame 582C 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=25623876&js=st_2
Requested by
Host: choices.truste.com
URL: https://choices.truste.com/ca?pid=sojern01&aid=sojern02&cid=25623876&js=st0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Accept-Encoding, Origin
content-type
text/javascript;charset=UTF-8
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
JAgLp4uDhfVsJy442QdRWknH8Vkz7w-eEe-FtzZh5jKHKZk40Hj3bg==
expires
Mon, 26 Jul 1997 05:00:00 GMT
cap
choices.trustarc.com/ Frame 582C 		43 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/cap?aid=sojern02&pid=sojern01&cid=25623876&w=300&h=250&c=e81a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
default-src 'self' 'unsafe-eval' *; font-src 'self' *; style-src 'self' 'unsafe-inline' *; img-src 'self' * data: https://cdn1.iconfinder.com https://js.userflow.com; frame-src 'self' *; frame-ancestors 'self' *; connect-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' *; media-src 'self' *; child-src 'self' *; worker-src 'self' *; manifest-src 'self' *;
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
x-amz-cf-pop
JFK50-P2
cross-origin-embedder-policy
unsafe-none
x-cache
Miss from cloudfront
cross-origin-resource-policy
cross-origin
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
origin
server
nginx
cross-origin-opener-policy
unsafe-none
expect-ct
max-age=31536000
x-frame-options
SAMEORIGIN
vary
Origin
content-type
image/gif
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
geolocation=(), microphone=(), payment=()
x-amz-cf-id
S09AE_kbPU7LA9d4JGwHnjG8yCOQ4p0RyGutbK2zTz9oxyDl5uTdXA==
expires
Mon, 26 Jul 1997 05:00:00 GMT
1235390588561432912
csync.smilewanted.com/set_partner_userid_get/adform/ Frame FE11
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
0
474 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68235dd046372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:49 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
server
nginx
5d62234a37f0646bf2303b81bf9e9a9f
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 8FDD
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/5d62234a37f0646bf2303b81bf9e9a9f?gdpr_consent=&gdpr=0
0
457 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/5d62234a37f0646bf2303b81bf9e9a9f?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682349bc06372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:49 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/5d62234a37f0646bf2303b81bf9e9a9f?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290289309069-144
visit.js
tps.doubleverify.com/ Frame 8B22 		724 B
749 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=677&ttfrms=13&brid=3&brver=114.0.5735.133&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=5102&ddur=24&uid=1687290289311399&jsCallback=dvCallback_1687290289311520&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&dvp_isOnHead=1&jsver=3941&tgjsver=3941&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dbdaakmyj%26e%3D1918623590599&fcifrms=26&brh=2&sdf=2&dvp_epl=196&noc=4&nav_pltfrm=Win32&ctx=13693614&cmp=29599255&sid=7119312&plc=364198308&crt=193069666&btreg=554237588&btadsrv=doubleclick&adsrv=1&advid=10627282&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=2625290450.2934413&dvp_tukv=62147593346.33358&dvp_strhd=0.20000076293945312&dvpx_strhd=0.20000076293945312&dvp_tuid=627285910012&jurtd=2810211281
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
3c22667dfaf40683c813ef6ef656953f5268a28a097df381857ad09ef21a206c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:49 GMT
Content-Encoding
br
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0
Connection
keep-alive
Timing-Allow-Origin
*
Expires
06/19/2023 19:44:49
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame AFD3 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152255
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da68234dbed6372-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 5207
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
423 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682353c466372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:49 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
async_usersync
ib.adnxs.com/ Frame 814F 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=10264&pub_id=2025736&gdpr=0
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=10264&pub_id=2025736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:49 GMT
AN-X-Request-Uuid
36d79857-e6fd-411b-b5a8-c7528344a5d3
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
csync.smilewanted.com/ Frame 6FB2 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d242bba7cc06e3d1b6938664f65ea42f256548886533a4e03281855dbab910b5

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682351c326372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 0E70 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46999
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:49 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291249
X-Served-By
cache-lga13626-LGA, cache-yul12821-YUL
X-Timer
S1687290289.465948,VS0,VE0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame FB29 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165952
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:49 GMT
expires
Thu, 22 Jun 2023 17:50:41 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
usync.html
eus.rubiconproject.com/ Frame C1AB 		281 B
401 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
233
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
etag
"40010-119-5ec73a0a33d00"
last-modified
Wed, 02 Nov 2022 02:30:44 GMT
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 1974
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?&rd=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D91%26partneruserid%3D%23PM_USER_ID%26gdpr%3DPM_GDPR%26gdpr_conse...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
43 B
716 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:49 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=91&partneruserid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
date
Tue, 20 Jun 2023 19:44:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
/
rtb-csync.smartadserver.com/redir/ Frame 1974
Redirect Chain
  • https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent=
  • https://stags.bluekai.com/site/23178?id=oRzH9Zt83axgglTEQFsr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33N...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC...
  • https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=oRzH9Zt83axgglTEQFsr
43 B
782 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=oRzH9Zt83axgglTEQFsr
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:49 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:50 GMT
Content-Type
text/html; charset=utf-8
Location
https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=oRzH9Zt83axgglTEQFsr
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
140
Expires
Thu, 01 Dec 1994 16:00:00 GMT
genericusersync.ashx
sync.tidaltv.com/ Frame 1974 		0
67 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:1c96:4103:9ee8:bc24:c1e4:34c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
awselb/2.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
server
awselb/2.0
content-length
0
content-type
text/plain; charset=utf-8
usermatch
ssum-sec.casalemedia.com/ Frame 1974 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssum-sec.casalemedia.com/usermatch?s=179394&cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D33%26partneruserid%3D&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
/
rtb-csync.smartadserver.com/redir/ Frame 1974
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=v5hJK9Sl&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=45bb695b-34f1-45bc-b104-fd1bfa86c044&gdpr=0
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=45bb695b-34f1-45bc-b104-fd1bfa86c044&gdpr=0
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=45bb695b-34f1-45bc-b104-fd1bfa86c044&gdpr=0
date
Tue, 20 Jun 2023 19:44:49 GMT
content-length
0
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 0BAF
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
511 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682358c8c6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:49 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
async_usersync
ib.adnxs.com/ Frame 83D8 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:49 GMT
AN-X-Request-Uuid
37c139f7-5e84-415c-9704-f50122b6b4f1
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
usync.html
eus.rubiconproject.com/ Frame 789A 		281 B
401 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
233
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
etag
"40010-119-5ec73a0a33d00"
last-modified
Wed, 02 Nov 2022 02:30:44 GMT
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
/
csync.smilewanted.com/ Frame 5F1A 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d242bba7cc06e3d1b6938664f65ea42f256548886533a4e03281855dbab910b5

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682353c4a6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame E241 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165952
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:49 GMT
expires
Thu, 22 Jun 2023 17:50:41 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame CA2E 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
46999
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:49 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 291250
X-Served-By
cache-lga13626-LGA, cache-yul12821-YUL
X-Timer
S1687290289.498477,VS0,VE0
genericusersync.ashx
sync.tidaltv.com/ Frame 9A8F 		0
66 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:1c96:4103:9ee8:bc24:c1e4:34c4 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
awselb/2.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
server
awselb/2.0
content-length
0
content-type
text/plain; charset=utf-8
pixel
cm.g.doubleclick.net/ Frame 9A8F
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
  • https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent=
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent=
Protocol
H3
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:49 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent=
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:49 GMT
cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
/
rtb-csync.smartadserver.com/redir/ Frame 9A8F
Redirect Chain
  • https://cms.quantserve.com/pixel/p-EtBqU4Lj3YbAv.gif?idmatch=0&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
43 B
716 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:49 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:49 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location
https://rtb-csync.smartadserver.com/redir/?partnerid=80&gdpr=0&partneruserid=x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
0
expires
Fri, 04 Aug 1978 12:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame 9A8F
Redirect Chain
  • https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&pubid=5679&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr_consent=null&gdpr=0
43 B
757 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr_consent=null&gdpr=0
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:49 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ff76b2fa-a2e6-48d5-8a14-13731d407294&gdpr_consent=null&gdpr=0
date
Tue, 20 Jun 2023 19:44:49 GMT
server
_
content-length
0
/
rtb-csync.smartadserver.com/redir/ Frame 9A8F
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
  • https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=smartadserver
  • https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=smartadserver
  • https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=48af5e8d-0e41-4408-b340-0efe3a2b26fc&ssp=smartadserver
  • https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=
43 B
822 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:50 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location
//rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=
Date
Tue, 20 Jun 2023 19:44:50 GMT
Cache-Control
no-cache, no-store, must-revalidate
Server
nginx
Connection
keep-alive
Content-Length
0
RrG2QWcZ9j7dv54OJsuG
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame B9C8
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
0
689 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682362d716372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:49 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:49 GMT Tue, 20 Jun 2023 19:44:49 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
pragma
no-cache
vevent
nym1-ib.adnxs.com/ Frame 582C 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QKZCvBMGQUAAAMA1gAFAQirg8ikBhCewOT6zIug8wcY1vWTicG84osuKjYJGoF4Xb9glz8R4SwYoUeokT8ZAAAAgML18D8h4SwYoUeokT8pG4EJJPCaMQAAACCF67E_MO7fwQ04mFBA6j9IAlCDo9mFAVi5q5cBYABopq60AXjh2AOAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCU3VmKCdhJywgMjk0MDY4MSwgMCk7dWYoJ2knLCA0ODIzODM1LCAwKTt1ZignZycsIDEyNzI3MzIxLCANKQByAT3wlTgwMzgzODc1LCAwKTuSAv0DIU0yZ1hQUWpGOU5NVkVJT2oyWVVCR0FBZ3VhdVhBVEFBT0FCQUFFanFQMUR1MzhFTldBQmdmbWdBY0FCNEFJQUJBSWdCQUpBQkFaZ0JBYUFCQWFnQkFiQUJBTGtCeC0zQjJkeGZsel9CQWNmdHdkbmNYNWNfeVFFQUFBQUFBQUR3UDlrQgEKAQF0OERfZ0FadTJwZ0wxQWMzTXpEMllBZ0NnQWdHMUFnASIEQzkJCPBVREFBZ0RJQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xPV1UweU9qVXhOamZnQS1sRGdBVGMzc1VFaUFUdnJNc0VrQVFCbUFRQndRUUEBYgUBCE1rRQUIBQEYRFlCQUR4QgUMCQFYaUFXdktLa0YwNlFVZEh0SjdULXhCUUEVARR3UVdhbVoFAhA1UDhrRgEZHElOTTN6VF9SLigACDJRVQEb0EFBQUR3UC1BRjZ4SHdCWm5vaUFiNEJZbS1zd0dDQmdOVlUwU0lCZ0NRQmdHWUJnQ2hCcHFaBV4sYmtfcUFZRXNnWWtDHYAARR0MAEcdDABJHQw4dUFZS5oCmQEheXhVWlhnOgECMExtcmx3RWdBQ2dBTVoZbQhPZ2w9URRkQTZVTkoBvwEBDDhEOVIBCAkBBEJaCQgBAQRCaAEGCQEEQnAJCAEBBEJ4AQYJARBCNEFJazVk9A4BOEQ4LtgCAOACm4VO6gIcaHR0cHM6Ly93d3cubWVyY3VyeW5ld3MuY29tL4ADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYA-YV4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDjE0OS41Ni4xNTMuMTg3qAQAsgQQCAAQARisAiD6ASgAMAA4ArgEAMAEAMgEANIEDjgxNzAjTllNMjo1MTY32gQCCAHgBAHwBIOj2YUBiAUBmAUAoAX___________8BwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFhQL6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG6CnaBhYKEAkRGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBugcIKgQxLS0tQAHIB-HYA9IHDQkRMwExDNoHBggFCWjgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=ff04a9a365c8b4f8e7c649c2ddd5795ccde6dedb&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=1615154911199896023&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:49 GMT
AN-X-Request-Uuid
a337fc7d-1f02-4f1c-943d-d9a5a0d0af59
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
dv-measurements3941.js
cdn.doubleverify.com/ Frame 3D75 		536 KB
102 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.doubleverify.com/dv-measurements3941.js
Requested by
Host: www.mercurynews.com
URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1400:9000::6875:b641 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
UploadServer /
Resource Hash
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:49 GMT
Content-Encoding
gzip
Last-Modified
Sun, 18 Jun 2023 10:24:03 GMT
Server
UploadServer
ETag
"245897220fbd1a0dfa41e714a5e3acf6"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Expose-Headers
*
Cache-Control
max-age=946080900
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103853
Expires
Mon, 17 Jun 2024 10:24:07 GMT
vevent
nym1-ib.adnxs.com/ Frame D6BE 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQirg8ikBhCv9-Xti4CH4k8Y1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjLxAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFuNTMxb1FqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMU1qVTM0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGaVNtUUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhATGdHQ2cuLpoCxQEhSXlNcUE-_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qVXlOVGRBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjUyNTfaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1MDA0uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABOVJQUVMxb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpTUozRUFBQUFBQUFBQUFIZ0FnUUVBQUFBKd0ASa0fMEpvQkFnZ0FxQUVBc1Fdj3xBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHy8QF0gcNCS63AIzaBwYIABAAGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=af6d5196c2ed199ad19ea2e844c6e645f3df6b1e&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=1615154911199896023&vd=ct~0|rr~0&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:49 GMT
AN-X-Request-Uuid
dfc3399c-ffd6-4340-942e-6585a54760be
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 7EB8 		22 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
49965
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 05:52:04 GMT
expires
Wed, 19 Jun 2024 05:52:04 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 1D7F 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152255
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da68236ce346372-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
async_usersync
ib.adnxs.com/ Frame F94E 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:49 GMT
AN-X-Request-Uuid
5e88e48e-0baf-4bee-bd06-2b77ce6ab382
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame A04B 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
543
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
usync.js
eus.rubiconproject.com/ Frame C1AB 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
content-encoding
gzip
last-modified
Tue, 20 Jun 2023 08:41:09 GMT
server
Apache/2.2.15 (CentOS)
x-powered-by
PHP/5.3.3
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control
max-age=46556
content-length
10113
expires
Wed, 21 Jun 2023 08:40:45 GMT
usync.js
eus.rubiconproject.com/ Frame 789A 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
content-encoding
gzip
last-modified
Tue, 20 Jun 2023 08:41:09 GMT
server
Apache/2.2.15 (CentOS)
x-powered-by
PHP/5.3.3
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control
max-age=46556
content-length
10113
expires
Wed, 21 Jun 2023 08:40:45 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame ACD4 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsujLPD3KPeUHBwoKtrBKPOs8CVqCGpQ3Lk9g8NzQxR7XbuS3J3vvZwkvYG82sEsspjtcRfkUTFLkADO6AufbqsYBfr7gylJwRw&sig=Cg0ArKJSzGax_6ydXV0AEAE&id=lidar2&mcvt=1298&p=0,0,250,300&mtos=1298,1298,1298,1298,1298&tos=1298,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=3210668679&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687290283242&rpt=5320&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:49 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
vevent
nym1-ib.adnxs.com/ Frame ACD4 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQirg8ikBhCLl7rC2q7Z4wQY1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjFpQWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFycDNZcHdqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMk5ESXg0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGbFRLUUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhMTGdHQ2cuLpoCxQEhSFNPdl9namcy_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qWTBNakZBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjY0MjHaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1Mjk1uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABR2hTWlVsb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpdktYRUFBQUFBQUFBQUFIZ0FnUUVBQUFBKd0ASa0fNEpvQkFnZ0FxQUVBc1FFCRwFAXguLoAHAYgHAKAHAboHCCoEMS0tLUAByAfFpQXSBw0JLrcAjNoHBggAEAAYAOAHAOoHAggA8AeRgAiKCAIQAJUIAACAP5gIAQ..&s=7dcbc8bc793b98de507c2b44c191dd0a3197ca97&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=1615154911199896023&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:50 GMT
AN-X-Request-Uuid
a04f0802-650b-402d-bd94-53f1580f61d6
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 6FB2 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152256
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da6823928a46372-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame 5F1A 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152256
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da6823928a56372-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
visit.js
tps.doubleverify.com/ Frame 3D75 		724 B
750 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=558&ttfrms=14&brid=3&brver=114.0.5735.133&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D%3E6C4FCJ%3F6HD%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3ETar9EEADTbpTauTauD%40A2%3D%3C%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=5341&ddur=33&uid=1687290290102540&jsCallback=dvCallback_1687290290102482&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F114.0.5735.133%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=250&winw=300&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=3941&tgjsver=3941&lvvn=28&m1=13&refD=2&referrer=https%3A%2F%2Fsopalk.com%2Fr%2Fp.html%3Ff%3Dcbyfcuv%26e%3D1918623590599&fcifrms=26&brh=2&sdf=2&dvp_epl=196&noc=4&nav_pltfrm=Win32&ctx=13693614&cmp=29599255&sid=7119312&plc=364198308&crt=193069666&btreg=554237588&btadsrv=doubleclick&adsrv=1&advid=10627282&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=180605215.93078998&dvp_tukv=9452344.49040022&dvp_strhd=0.2999992370605469&dvpx_strhd=0.2999992370605469&dvp_tuid=1123048323107&jurtd=2426758659
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
3333d3f60d4bab99e3b9765289a0cb56863e6dc65f15e65a7457d187dafb4ac4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:50 GMT
Content-Encoding
br
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=0
Connection
keep-alive
Timing-Allow-Origin
*
Expires
06/19/2023 19:44:50
drop_cookie_sw.php
csync.smilewanted.com/ Frame A68F 		0
503 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823999066372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding
async_usersync
ib.adnxs.com/ Frame 0E70 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:50 GMT
AN-X-Request-Uuid
939dde6b-6620-4588-bab0-a8c20095e229
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
get
choices.trustarc.com/ Frame 582C 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
156958
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
oNZQKDFU-LgFQBiHkFzZteuU-a694M5qc9QoEtnaUZEJxYUtDcFvvg==
expires
Wed, 19 Jul 2023 00:08:52 GMT
async_usersync
ib.adnxs.com/ Frame CA2E 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:50 GMT
AN-X-Request-Uuid
81e26c81-2aae-4054-b346-11597c356702
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
pagead2.googlesyndication.com/bg/ Frame 7EB8 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/F23xA4-E8U0dLsM7Ua-M74A0tuvycQb5txb3FNVg6II.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:35:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
544
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14698
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 09:28:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 19 Jun 2024 19:35:46 GMT
G2VgbPZHuyVpOjRtQ-i3ojE3
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame 77B4
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823aea566372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:50 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
X-Sovrn-Pod
ad_ap4ewr1
generate_204
tpc.googlesyndication.com/ Frame 12CA 		0
10 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?8gLt1g
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80d::2001 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:50 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
drop_cookie_sw.php
csync.smilewanted.com/ Frame B385 		0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823a59ba6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding
/
sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/ Frame 2B38
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://x.bidswitch.net/sync?ssp=richaudience&gdpr=0&gdpr_consent=&user_id=397b5886-1416-4626-ba56-1zz1687290289
  • https://ads.betweendigital.com/match?bidder_id=43092&gdpr=0&consent=&callback_url=https%3A%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D429%26user_id%3D%24%7BUSER_ID%7D%26ssp%3Drichaudience%26expires%3D3...
  • https://x.bidswitch.net/sync?dsp_id=429&user_id=e85e87b7-5c57-53ab-9b57-f4bcffc5f50d&ssp=richaudience&expires=30&user_group=1&gdpr=0&gdpr_consent=
  • https://sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=&us_ps=
95 B
379 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=&us_ps=
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.201.8.249 Ergolding, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.249.8.201.138.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:44:49 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx/1.14.1
x-powered-by
PHP/8.2.4

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:50 GMT
Location
//sync.richaudience.com/697a8452aebbe5875da0878cfaf3d0d0/?uid=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=&us_ps=
Server
nginx
RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
sync.targeting.unrulymedia.com/csync/ Frame AA58
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005&rndcb=5442216007
  • https://t.pswec.com/bsw_sync?ssp=adconductor&bsw_user_id=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://t.pswec.com/ul_cb/bsw_sync?ssp=adconductor&bsw_user_id=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://x.bidswitch.net/sync?dsp_id=2&user_id=7ad943f4-c122-4afd-821a-f70b289c410c&expires=3&user_group=1&ssp=adconductor
  • https://sync.1rx.io/usersync/bidswitch/2491035f-3b91-450a-bf47-d3da43a3fb7b?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
43 B
452 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.127.204.171 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Connection
keep-alive
Content-Length
43
Date
Tue, 20 Jun 2023 19:44:50 GMT
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server
Tengine

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:50 GMT
Expires
0
Location
https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Pragma
no-cache
Server
Tengine
Transfer-Encoding
chunked
G2VgbPZHuyVpOjRtQ-i3ojE3
csync.smilewanted.com/set_partner_userid_get/sovrn/ Frame 29C8
Redirect Chain
  • https://ap.lijit.com/pixel?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fsovrn%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823b0a866372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:50 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/sovrn/G2VgbPZHuyVpOjRtQ-i3ojE3
X-Sovrn-Pod
ad_ap4ewr1
activeview
pagead2.googlesyndication.com/pcs/ Frame D6BE 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstMf92nuEv0TEfvkYn41EJQ7dnOYU6Wf1apruKAyt_ApF3cP1jLA4vYJeKKUTARM5eAPfPXDiLj6CeBmO9NX7EEl2fFXw46yoE&sig=Cg0ArKJSzEcagSnW6-0-EAE&id=lidar2&mcvt=1078&p=0,0,250,300&mtos=1078,1078,1078,1078,1078&tos=1078,0,0,0,0&v=20230614&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=32&adk=1241189742&rs=6&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687290283238&rpt=5976&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:50 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
get
choices.trustarc.com/ Frame 8330 		287 B
627 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02_d&pid=sojern01&cid=0&w=300&h=250&c=380229093&js=pmw2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
156958
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
lo8cNjrftvu6gYexcFyAEBrFHax-R47nP-6qJFxBEWr2V2nhfK9WpA==
expires
Wed, 19 Jul 2023 00:08:52 GMT
get
choices.trustarc.com/ Frame 8330 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Sun, 18 Jun 2023 12:17:59 GMT
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
199611
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
739
x-amz-cf-id
S_AmrBSEzOc0tHJJvwkeT1O3maSzb8i1DlRWS7CHkUURcNdhAvBHmw==
expires
Tue, 18 Jul 2023 12:17:59 GMT
e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 2F56
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
0
541 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823b5ac76372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
/
sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/ Frame 9809
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://sync.smartadserver.com/getuid?url=https%3A%2F%2Fsync.richaudience.com%2F1a12a024f8f9561c49164bbaf87ed164%2F%3Fuid%3D[sas_uid]&gdpr_consent=&nwid=2441/
  • https://sync.smartadserver.com/getuid?url=https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=[sas_uid]&gdpr_consent=&nwid=2441/&cklb=1
  • https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4777538607685951564
95 B
366 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4777538607685951564
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.201.8.249 Ergolding, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.249.8.201.138.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:44:49 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx/1.14.1
x-powered-by
PHP/8.2.4

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://sync.richaudience.com/1a12a024f8f9561c49164bbaf87ed164/?uid=4777538607685951564
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame F63E
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
560 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823b9af86372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:50 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
/
rtb-csync.smartadserver.com/redir/ Frame 073A
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005&rndcb=6632179801
  • https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=adconductor&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b&google_hm=MjQ5MTAzNWYtM2I5MS00NTBhLWJmNDctZDNkYTQzYTNm...
  • https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESECMp9F8FTIWYgeQlriR_w6E&google_cver=1&ssp=adconductor&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://sync.1rx.io/usersync/bidswitch/2491035f-3b91-450a-bf47-d3da43a3fb7b?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fpartnerid%3D113%26partneruserid%3DRX-0582ffcc-0...
  • https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
43 B
870 B 		Document
General
Check archive.org
Download Go to
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
no-cache,no-store
content-type
image/gif
date
Tue, 20 Jun 2023 19:44:49 GMT
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
pragma
no-cache
transfer-encoding
chunked

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:50 GMT
ETag
RX0582ffcc029a4b6a9d8acee11ea1f0b8005
Location
https://rtb-csync.smartadserver.com/redir/?partnerid=113&partneruserid=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server
Tengine
Transfer-Encoding
chunked
1235390588561432912
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 6D40
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
0
531 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823c4bc16372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
server
nginx
drop_cookie_sw.php
csync.smilewanted.com/ Frame 9638 		0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823b9afe6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding
drop_cookie_sw.php
csync.smilewanted.com/ Frame 1CEE 		0
90 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823bab086372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding
e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 91AE
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823bdb3f6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
f39057767042789454688717f4d2f3ca
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame E0DE
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/f39057767042789454688717f4d2f3ca?gdpr_consent=&gdpr=0
0
482 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/f39057767042789454688717f4d2f3ca?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823c6be16372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:50 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/f39057767042789454688717f4d2f3ca?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290290575016-288
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 7F27
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
90 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823c3ba46372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:50 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
/
sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/ Frame BE35
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://match.prod.bidr.io/cookie-sync/richaudience&gdpr=0&gdpr_consent=
  • https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
95 B
370 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.201.8.249 Ergolding, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.249.8.201.138.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:44:49 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx/1.14.1
x-powered-by
PHP/8.2.4

Redirect headers

Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:50 GMT
Server
gunicorn
location
https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
strict-transport-security
max-age=2592000; includeSubDomains
/
sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/ Frame 3E06
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F
  • https://sync.richaudience.com/bf7c142f4339da0278e83698a02b0854/?consentString=&referrer=https%3A%2F%2Fcsync.smilewanted.com%2F&rd=1
  • https://match.prod.bidr.io/cookie-sync/richaudience&gdpr=0&gdpr_consent=
  • https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
95 B
370 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.201.8.249 Ergolding, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.249.8.201.138.clients.your-server.de
Software
nginx/1.14.1 / PHP/8.2.4
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
image/png
date
Tue, 20 Jun 2023 19:44:49 GMT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
server
nginx/1.14.1
x-powered-by
PHP/8.2.4

Redirect headers

Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:50 GMT
Server
gunicorn
location
https://sync.richaudience.com/5cabe097b3ebe2daf96e0f4655657171/?uid=AAEDUk7JJAMAACROtOIu9g
strict-transport-security
max-age=2592000; includeSubDomains
usync.html
eus.rubiconproject.com/ Frame AA70 		281 B
401 B 		Document
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) /
Resource Hash
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
233
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
etag
"40010-119-5ec73a0a33d00"
last-modified
Wed, 02 Nov 2022 02:30:44 GMT
server
Apache/2.2.15 (CentOS)
vary
Accept-Encoding
/
csync.smilewanted.com/ Frame A710 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/?us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b18a444786e87c2665b14a39523fa453710642cbc629823d448bc3e88f14219b

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823c2b9e6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding
async_usersync.html
acdn.adnxs.com/dmp/ Frame 5C4A 		52 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://acdn.adnxs.com/dmp/async_usersync.html
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx/1.18.0 (Ubuntu) /
Resource Hash
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Age
47000
Cache-Control
max-age=86402
Connection
keep-alive
Content-Encoding
gzip
Content-Length
17053
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:50 GMT
ETag
W/"623de86a-cf34"
Expires
Wed, 24 May 2023 07:58:00 GMT
Last-Modified
Fri, 25 Mar 2022 16:06:02 GMT
Server
nginx/1.18.0 (Ubuntu)
Vary
Accept-Encoding
Via
1.1 varnish, 1.1 varnish
X-Cache
HIT, HIT
X-Cache-Hits
3253, 290829
X-Served-By
cache-lga13626-LGA, cache-yul12832-YUL
X-Timer
S1687290291.588218,VS0,VE0
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 35A9 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165951
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:50 GMT
expires
Thu, 22 Jun 2023 17:50:41 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
/
rtb-csync.smartadserver.com/redir/ Frame 7C4E
Redirect Chain
  • https://b1sync.zemanta.com/usersync/smart/?cb=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D116%26partneruserid%3D__ZUID__&gdpr=0&gdpr_consent=
  • https://stags.bluekai.com/site/23178?id=oRzH9Zt83axgglTEQFsr&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33N...
  • https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIWWG43ZNZRS443NMFZHIYLEONSXE5TFOIXGG33NF5ZGKZDJOIXT6ZLYMNUGC3THMU6XG3LBOJ2CMZ3EOBZD2MBGNFZXG2J5GETHAYLSORXGK4TJMQ6TCMJWEZYGC...
  • https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=oRzH9Zt83axgglTEQFsr
43 B
901 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=oRzH9Zt83axgglTEQFsr
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:50 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:50 GMT
Content-Type
text/html; charset=utf-8
Location
https://rtb-csync.smartadserver.com/redir/?gdpr=0&issi=1&partnerid=116&partneruserid=oRzH9Zt83axgglTEQFsr
P3p
CP="We do not support P3P header."
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
140
Expires
Thu, 01 Dec 1994 16:00:00 GMT
RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
sync.targeting.unrulymedia.com/csync/ Frame 7C4E
Redirect Chain
  • https://sync.1rx.io/usersync2/smartadserver?gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?ssp=adconductor&user_id=RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005&rndcb=5224921595
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=adconductor&bsw_custom_parameter=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=1d360e72-ed0a-468d-af20-61ff2dc87248&ssp=adconductor&expires=30&user_group=5&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b
  • https://sync.1rx.io/usersync/bidswitch/2491035f-3b91-450a-bf47-d3da43a3fb7b?gdpr=&gdpr_consent=
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
43 B
452 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Protocol
HTTP/1.1
Server
199.127.204.171 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
Tengine /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:51 GMT
Server
Tengine
Connection
keep-alive
Content-Length
43
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:51 GMT
Server
Tengine
Transfer-Encoding
chunked
Content-Type
text/html
Location
https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Expires
0
/
rtb-csync.smartadserver.com/redir/ Frame 7C4E
Redirect Chain
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=76&partneruserid=GOOGLE_HOSTED_SI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_sc...
  • https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_sc&google_hm=NDc3NzUzODYwNzY4NTk1MTU2NA==&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEN6Bv2XV7wpWXcvjVaO6wck&gdpr=0&gdpr_consent=&google_cver=1
43 B
901 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEN6Bv2XV7wpWXcvjVaO6wck&gdpr=0&gdpr_consent=&google_cver=1
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:50 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:50 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESEN6Bv2XV7wpWXcvjVaO6wck&gdpr=0&gdpr_consent=&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
345
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
rtb-csync.smartadserver.com/redir/ Frame 7C4E
Redirect Chain
  • https://eu-u.openx.net/w/1.0/cm?id=a547219b-814b-4e3e-8a4f-35c044fa1891&ph=ec81d0b7-c42e-4a42-b97a-9305af647d30&r=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D100%2...
  • https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=318dfbf2-48b4-46ac-b8e6-a6e824a12e17
43 B
863 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=318dfbf2-48b4-46ac-b8e6-a6e824a12e17
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:50 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

date
Tue, 20 Jun 2023 19:44:50 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
location
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=100&partneruserid=318dfbf2-48b4-46ac-b8e6-a6e824a12e17
p3p
CP="CUR ADM OUR NOR STA NID"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
/
rtb-csync.smartadserver.com/redir/ Frame 7C4E
Redirect Chain
  • https://dsp.adfarm1.adition.com/cookie/?ssp=5&gdpr=0&gdpr_consent=
  • https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7246856614452983954&gdpr=0&gdpr_consent=
43 B
924 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7246856614452983954&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Server
23.105.14.106 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
23.105.14.106.rdns.racklot.com
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:50 GMT
cache-control
no-cache,no-store
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Location
https://rtb-csync.smartadserver.com/redir/?partnerid=49&partneruserid=7246856614452983954&gdpr=0&gdpr_consent=
Date
Tue, 20 Jun 2023 19:44:50 GMT
Server
nginx
Connection
keep-alive
Transfer-Encoding
chunked
p3p
policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
get
choices.trustarc.com/ Frame 7B28 		287 B
628 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-icon-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=25623876&js=st_2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Mon, 19 Jun 2023 00:08:52 GMT
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
156958
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
287
x-amz-cf-id
NUzdwJroMu4xzs2g_0wRGSEr0QtEOj3ovyLf6YaCfNMreES9qODjtw==
expires
Wed, 19 Jul 2023 00:08:52 GMT
get
choices.trustarc.com/ Frame 7B28 		739 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://choices.trustarc.com/get?name=admarker-full-tr.png
Requested by
Host: choices.trustarc.com
URL: https://choices.trustarc.com/ca?aid=sojern02&pid=sojern01&cid=25623876&js=st_2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.29.51 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-29-51.jfk50.r.cloudfront.net
Software
nginx /
Resource Hash
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
public
date
Sun, 18 Jun 2023 12:17:59 GMT
via
1.1 56e001f87fa53501872a21f09bb07046.cloudfront.net (CloudFront)
server
nginx
x-amz-cf-pop
JFK50-P2
age
199611
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=2592000
timing-allow-origin
*
content-length
739
x-amz-cf-id
u3HAMnrKgiIsu6fTKP3yk3AQpP6MqlMA4Xm2CQqVG3oKWLFugVHI7A==
expires
Tue, 18 Jul 2023 12:17:59 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 0A5D 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQlcHrgGSZKbVDJLI1wXQvaOYAgAAAAA4AeAEAg&bg=!qaqlqv7NAAaGYqkwpmI7ADkAdvg8WsnIjX5nF9tY_1R5aoOEpjqxb-QZ2qcvviYELqQWcDt_YxCp3N0Jpvb-C7dBeZdBDL-lTYcCAAAHgFIAAAADaAEHmQMAtRVcumOOCr2_wmW-diI6KqFgPa1DCODhWicgyL6t2vJlupLnEi81kqqwr1dsoxCDdkq3y8QKSNMxADaVURf1iBOyEM-_59VYa-rbiPicxK-PUR0Cyu7usYLD6UELMiZK9J4D9husf-CA9FKU6yrOajSFhxaJZI0Tw6cWtyrbSLJx4iG_98wzOXiPXEivFKK0S7n_d6UBMU-_w9jox6jZO4cCfJt6C9FhmUQUT7OTZAnDUHphHhKbSakOhZw-VJQpTszLCJIXcoHUehl6Dy6UBmmUqt60eumb2-AxxD_CBjzSAVslhsCKLGylr6T3vOQXREwQNS62peEeB5hL_Ux5zCTmpVpNfeT5vWorid4eudx42vfQ2RtQ2vnGWz6Ka4zaZenbzS0HL5e5j_7ZF1unDmWktv_BZFzHn5LQE21fSQfiw_xKeUJXeWLDiPGBctcko1IgMqXQ_f9jvDhj63bL9pbiVvfEDTYdcsw2q_BeoT6GzzZOch_BVTbjAzG-6VLJBHehPGZ0Qn37RDGFujgC1if6006gQbGVXM9HY4AtsctAsLm_Wdq-BoRbsxL1P12VLXNe8Ry3d7EyWbYtJfn0vlisEijtkm6kOtI-guil0KJMOzeUSsOsyN5FcGE6YW1ak_VwWYTXFxMTzAfaTvKHRQTub7PGGz0IOevlvTt38QW8LvHOh9T8VajxzeM2-qWRxDon6axLZletlCeoTYkSnJNHM-IRWR8Q-LGopkQBRMTAo01VL5uqzCH5rzZLto4G-0SNL9qWj39HBqQvJRAVJPiVhDSC-_TjZZpQxI7AkWjhU6xZtLRO_l2jIKiJJAJvS0xsCLT3h3OVwHvIRf_7DYTRNhzfvnJIRSvolKVSZ1FKbb6lWTQG4aOoQhXg-XMPkt6xS_vW5KduWP-yo9O3jA86SI8dXYhbDI3GnnTq_E2DzpXu_mSoyxYy2KbBRXuq2i0QnBHkeEHHU172tILWXnbtm7l2Y14BBJgUaNBaEvs5fRGnnVlF19EzNJ8N1Klu
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:50 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 0F65
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
790 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823c8bfa6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
1235390588561432912
csync.smilewanted.com/set_partner_userid_get/adform/ Frame C01E
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
0
550 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d4cea6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
server
nginx
RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame 81E4
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&rndcb=7976228035
  • https://sync.1rx.io/usersync/rubicon/LJ4P2KW9-15-LLQ7
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-0582ffcc-029a-4b6a-9d8a-cee...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
0
618 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823ded7a6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:50 GMT
ETag
RX0582ffcc029a4b6a9d8acee11ea1f0b8005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server
Tengine
Transfer-Encoding
chunked
SPug
simage4.pubmatic.com/AdServer/ Frame 3692 		0
128 B 		Script
General
Check archive.org
Download Go to
Full URL
https://simage4.pubmatic.com/AdServer/SPug?partnerID=156383&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:49 GMT
cache-control
no-store, no-cache, private
server
nginx
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame 826B
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://pixel.rubiconproject.com/exchange/sync.php?p=unruly&rndcb=320679509
  • https://sync.1rx.io/usersync/rubicon/LJ4P2KW9-15-LLQ7
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-0582ffcc-029a-4b6a-9d8a-cee...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
0
651 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823dbd496372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:50 GMT
ETag
RX0582ffcc029a4b6a9d8acee11ea1f0b8005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server
Tengine
Transfer-Encoding
chunked
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame B56A
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
610 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d2cb96372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:50 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
922b9b5de53a83057b6ee4965f3d361
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 0449
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/922b9b5de53a83057b6ee4965f3d361?gdpr_consent=&gdpr=0
0
540 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/922b9b5de53a83057b6ee4965f3d361?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d2cbc6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:50 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/922b9b5de53a83057b6ee4965f3d361?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290290653093-291
e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame D0B8
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
0
135 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d2cbe6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame 4024
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d2cc06372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
usync.js
eus.rubiconproject.com/ Frame AA70 		34 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://eus.rubiconproject.com/usync.js
Requested by
Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.127.172.242 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-127-172-242.deploy.static.akamaitechnologies.com
Software
Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:50 GMT
content-encoding
gzip
last-modified
Tue, 20 Jun 2023 08:41:09 GMT
server
Apache/2.2.15 (CentOS)
x-powered-by
PHP/5.3.3
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
p3p
CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
cache-control
max-age=46555
content-length
10113
expires
Wed, 21 Jun 2023 08:40:45 GMT
RrG2QWcZ9j7dv54OJsuG
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 1177
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
0
482 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d9d2f6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:50 GMT Tue, 20 Jun 2023 19:44:50 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
pragma
no-cache
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 2CDD
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d2cc16372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 7DDC
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
766 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d4cee6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:50 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame E86D
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
553 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d6d076372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:50 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 4C20
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
612 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823d8d236372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:50 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
1235390588561432912
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 11F8
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
0
81 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823e1da26372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
server
nginx
1235390588561432912
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 83D9
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
0
624 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823e1da36372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
server
nginx
RrG2QWcZ9j7dv54OJsuG
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame F079
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
0
550 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823e3dc16372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:50 GMT Tue, 20 Jun 2023 19:44:50 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
pragma
no-cache
c73f079468a9778d6dba7d2f5443dc3
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 823C
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/c73f079468a9778d6dba7d2f5443dc3?gdpr_consent=&gdpr=0
0
792 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/c73f079468a9778d6dba7d2f5443dc3?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823e1da76372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:50 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/c73f079468a9778d6dba7d2f5443dc3?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290290843026-259
f76549c7243c44b1d97f895bf5069c2
csync.smilewanted.com/set_partner_userid_get/freewheel/ Frame 6AC0
Redirect Chain
  • https://ads.stickyadstv.com/user-matching?id=3602&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/freewheel/f76549c7243c44b1d97f895bf5069c2?gdpr_consent=&gdpr=0
0
569 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/freewheel/f76549c7243c44b1d97f895bf5069c2?gdpr_consent=&gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823e1da86372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:50 GMT
Location
https://csync.smilewanted.com/set_partner_userid_get/freewheel/f76549c7243c44b1d97f895bf5069c2?gdpr_consent=&gdpr=0
Pragma
no-cache
Server
nginx
x-sticky-vk
1687290290842032-276
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 0FA8
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
112 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823e1da56372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
async_usersync
ib.adnxs.com/ Frame 5C4A 		0
861 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/async_usersync?cbfn=queuePixels
Requested by
Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://acdn.adnxs.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:50 GMT
AN-X-Request-Uuid
4fb7504c-7413-422b-9352-1d339c51e806
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 4720
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
575 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823e1da66372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
PugMaster
image6.pubmatic.com/AdServer/ Frame 35A9 		573 B
831 B 		Script
General
Check archive.org
Download Go to
Full URL
https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=93933450&p=156383&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=1---
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=156383&us_privacy=1---
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
/
Resource Hash
ff0240758b9e151bb465c9876e639325aeffc609f19d61f070de6b918636e25b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date
Tue, 20 Jun 2023 19:44:50 GMT
content-length
573
content-type
text/html; charset=UTF-8
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame BB84
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
604 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823e5df36372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:50 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame EF14
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
604 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823e5df46372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:50 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
RrG2QWcZ9j7dv54OJsuG
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame FABE
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
0
100 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823f4efb6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:51 GMT Tue, 20 Jun 2023 19:44:51 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
pragma
no-cache
RrG2QWcZ9j7dv54OJsuG
csync.smilewanted.com/set_partner_userid_get/rtbhouse/ Frame 53D2
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=smilewanted
  • https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
0
765 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823f5f0b6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:51 GMT Tue, 20 Jun 2023 19:44:51 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/rtbhouse/RrG2QWcZ9j7dv54OJsuG?pi=smilewanted
pragma
no-cache
vevent
nym1-ib.adnxs.com/ Frame D6BE 		0
950 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://nym1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwww.mercurynews.com%2F&e=wqT_3QLyDfBM8gYAAAMA1gAFAQirg8ikBhCv9-Xti4CH4k8Y1vWTicG84osuKjYJeyx96IL6dj8ROFOQu-KLcT8ZAAAAgML18D8hOFOQu-KLcT8peywJJPCaMQAAACCF67E_MO7fwQ04mFBA9WRIAlC8ltfNAVi5q5cBYABopq60AXjLxAWAAQGKAQNVU0SSAQNFVVKYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABAIoCaXVmKCdhJywgNTUyMTA2OCwgMCk7dWYoJ2knLCA4Mjk1Nzk2LCAwKTt1ZignZycsIDIxMDg5MzY2LCANKThzJywgMjg0NzMyNjk1LCANFiByJywgNDMxMzQBAQUW9GkBkgL5BSFuNTMxb1FqZ2gtSWFFTHlXMTgwQkdBQWd1YXVYQVRBQk9BQkFBRWoxWkZEdTM4RU5XQUJnZm1nQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFxZ0JBckFCQUxrQm51YXAyM0paZmpfQkFVZ2I1NGJULW5ZX3lRRUFBQUFBd2xQdVA5a0JOank5VXBZaDlUX2dBZlNxLWdQMUFUajdfejZZQWdDZ0FnSzFBZ0FBQUFDOUFnQUFBQURBQWdESUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0dpQXc0STFKdUhLeEFDR0FJdEFBQUFBS0lERndpeWljQXNFQVlZQVMySzZMazNNZ2RrWldaaGRXeDBvZ01XQ082NndDd1FDaGdCTFJDZWNqOHlCblZ1YVhGMVphSUREZ2pVbTRjckVBc1lBaTBBQUFBQXVnTUpUbGxOTWpvMU1qVTM0QVBwUS1rREEBswUBRER3QTk4VGdBU2JpZWNLaUFTZgEIuGtBUUJtQVFFc2dRS0NPVENtUTBRb0xPMERib0VHZ2llQ1JFcFhJX0M5U2pNUHhrBUoFASRDRGt3cGtOd1FRGSAIOGtFBRwFARhEWUJBUHhCBQwJAfBSZ2dVZkNLSExKUkFGR0FFaUEwTkJSQ2syUEwxU2xpSDFQekZDWU9YUUl0dkpQNGdGaVNtUUJjTDJUcGdGbDlyaWh3R3BCZE9rRkhSN1NlMF9zUVUJWQEBCE1FRgEHCQEMREpCUQEKIEIzOGRJXzBRVQENCQEETmsVKLg4RF9nQmJFRThBWFdtSWNLLUFXc19kQUNnZ1lEUTBGRWlBWUVrQVlCbUFZQW9RWQlAAQEkS2dHQkxJR0pBawEOCQEAQh37BEJrCRQBAQBDHRhATGdHQ2cuLpoCxQEhSXlNcUE-_QIsTG1ybHdFZ0FDZ0FNBcEJAXxPZ2xPV1UweU9qVXlOVGRBNlVOSk5qeTlVcFloOVQ5UgkmAQEEQloBBgkBNEJoS1Z5UHd2VW96RDlwCRQBAQRCeAEGCQFhSVRJQkh3aWh5eVVRQlJnQklnTkRRVVFwGWA4OHhRbURsMENMYnlULUpBEZj0mwFQQV_YAgDgApuFTuoCHGh0dHBzOi8vd3d3Lm1lcmN1cnluZXdzLmNvbS-AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2APmFeADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA4xNDkuNTYuMTUzLjE4N6gEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADSBA8xMjkxNyNOWU0yOjUyNTfaBAIIAeAEAfAEvJbXzQGIBQGYBQCgBf___________wHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWo4Eb6BQQIABAAkAYAmAYAogYPMTAyNjQjTllNMjo1MDA0uAYAwQYAAAAAAADwP9AGnqsC2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGhwEIwvZOEoABOVJQUVMxb0FBQUFEQUFrQ0JRRUkwUEwzQnhDLTFib0NHT3lFbHdNZ0J5Z0FRTEMwdWdkSXY3VzZCMURwUTFpTUozRUFBQUFBQUFBQUFIZ0FnUUVBQUFBKd0ASa0fMEpvQkFnZ0FxQUVBc1Fdj3xBLi6ABwGIBwCgBwG6BwgqBDEtLS1AAcgHy8QF0gcNCS63AIzaBwYIABAAGADgBwDqBwIIAPAHkYAIiggCEACVCAAAgD-YCAE.&s=af6d5196c2ed199ad19ea2e844c6e645f3df6b1e&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=1615154911199896023&vd=ct~0|rr~5&sv=236&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=28340206&ft=3
Requested by
Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/236/trk.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.75 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:50 GMT
AN-X-Request-Uuid
8f38f0c1-9bda-456c-8667-e8c0258b4b69
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://sopalk.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
setuid
ib.adnxs.com/prebid/ Frame 6940
Redirect Chain
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%...
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
43 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

AN-X-Request-Uuid
1a5a2c03-f3b1-4fce-99b2-435a0a2cb772
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:51 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823ede6a6372-ORD
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
location
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
server
cloudflare
setuid
ib.adnxs.com/prebid/ Frame 6850
Redirect Chain
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%...
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
43 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

AN-X-Request-Uuid
7663b5d4-53b6-40cc-8194-da2db2a25027
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:51 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6823ede6e6372-ORD
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
location
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
server
cloudflare
75145
i.liadm.com/s/ Frame 35A9 		43 B
641 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.liadm.com/s/75145?bidder_id=195755&bidder_uuid=479CC621-B2E0-490D-8915-42055EBBC0EB
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.92.222.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-92-222-20.compute-1.amazonaws.com
Software
/
Resource Hash
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:51 GMT
Cache-Control
no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
43
Request-Time
2
Content-Type
image/gif
qmap
sync.crwdcntrl.net/ Frame 35A9 		49 B
265 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=479CC621-B2E0-490D-8915-42055EBBC0EB&gdpr=0&gdpr_consent=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.72.123.193 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-72-123-193.compute-1.amazonaws.com
Software
Jetty(9.4.38.v20210224) /
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:51 GMT
server
Jetty(9.4.38.v20210224)
content-type
image/gif
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin
*
cache-control
no-cache
x-server
10.40.40.237
content-length
49
expires
0
/
io.narrative.io/ Frame 35A9
Redirect Chain
  • https://io.narrative.io/?companyId=673&id=pubmatic_id:479CC621-B2E0-490D-8915-42055EBBC0EB
  • https://io.narrative.io/?io.narrative.guid.v2=ebe4c0e1-0fa2-11ee-a591-0a3986670f6f&companyId=673&id=pubmatic_id:479CC621-B2E0-490D-8915-42055EBBC0EB
0
247 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://io.narrative.io/?io.narrative.guid.v2=ebe4c0e1-0fa2-11ee-a591-0a3986670f6f&companyId=673&id=pubmatic_id:479CC621-B2E0-490D-8915-42055EBBC0EB
Protocol
HTTP/1.1
Server
54.84.229.185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-84-229-185.compute-1.amazonaws.com
Software
nginx/1.22.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:51 GMT
Cache-Control
no-cache
Server
nginx/1.22.1
Connection
keep-alive

Redirect headers

Location
https://io.narrative.io/?io.narrative.guid.v2=ebe4c0e1-0fa2-11ee-a591-0a3986670f6f&companyId=673&id=pubmatic_id:479CC621-B2E0-490D-8915-42055EBBC0EB
Date
Tue, 20 Jun 2023 19:44:51 GMT
Server
nginx/1.22.1
Connection
keep-alive
Content-Length
0
p
a.audrte.com/ Frame 35A9
Redirect Chain
  • https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=479CC621-B2E0-490D-8915-42055EBBC0EB
  • https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=ZzJiaHNYNmJkMXRSNEttWDNkcXYtdnRHZw==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL...
  • https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
  • https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
  • https://a.audrte.com/a?adform_uid=1235390588561432912&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D
  • https://a.audrte.com/p
68 B
424 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.audrte.com/p
Protocol
HTTP/1.1
Server
52.44.244.58 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-44-244-58.compute-1.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ads.pubmatic.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Tue, 20 Jun 2023 19:44:51 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Content-Type
image/png
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
68

Redirect headers

Date
Tue, 20 Jun 2023 19:44:51 GMT
Server
nginx/1.18.0
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods
POST, GET, OPTIONS
Access-Control-Allow-Origin
*
Location
https://a.audrte.com:443/p
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame A04B 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BV6rZsAGSZJauCM7pzwWy5J34DgAAAAA4AeAEAg&bg=!7u2l7bnNAAaGYqkwpmI7ADkAdvg8WiYxBGFuY2IQKWADIZVBC3LW4N_B2YrS6KbR7SqgtJbcYjIAEIR7yXd0ohpjHVLZ0Cs6c-0CAAADSlIAAAAFaAEHmQMXKdu-q372-7dp6INdejqSDC0MCdbs4O_b7pRRVN6EoM1ZNK77RPCjec1VwnLNEDuCOFZcGDkI7sBKnYTyy25GAKUazTuP_qtfXKUbjUEpUMjrm2WSSe8T3hKYUjBSlI4MMGOK16QQtQbMdfsx73RMNsiAIUrMevftHx5BH3BwtngSxfKZrk56cfmgCD9wrw-NdO9dc9QRPA990teeB_0qHaeOih3ovk7B_WP7YmvUOhw_PtqYXWSDJxNGYiLYfm8FKlt3hSqmtg6dlUffvqmmdwmP7T7u-u-t4nTi5kekefsK__Py2R76hm5T1SZL3XaRdBF8gAF51y27WokCjv8isBmjVpicDowLMUuVTJ0GrxzHGxA5cCU4ZU3DSPP9lemMfQiG9_Mu6mlvZqxjMMnHM3FNooiv8eYxSMEEKpWJf5IWfwIzHhGdvhSdNyxPw60DKUh2czEDBTVnst5HQlKbbAxuNSEhpyc0Ka9nJrNBYF-nmHPyKEfwcSctLVy8kPtOcM4gEOV1BCht1Mcmia2ECkYD661DyqdVoxxpyeXnirYinzaxWlg-O4-eRqnAWvMHSMrBUxPX1MLZQxBwvh3H8YVsKGHKmj1ZMVgUm9GiFqMYN3NeMV5GbJlhZcwiKi_Yqw4LBFQ_vR4ULTFtpT7ocms0L_7qiOjGCDf9RRTiQ9xheFRjyglCTlyKB5d7TOeZyVMADG5t120wqqyjM-CI1tyG2VDx3YQExTlif7DDQgLXXauiSW9uOBFJlgScB_NWSAti_y4tgKO_JHR0V6Y0oyukNo3jtvKsLkI2VE05c3kkvd7ImJnbKL2qvc0a7Ujpoc_oE2DfNMJw3uGKrUq30jgwa5dFBMfLBYgyKs8wDx2l8q5tkOUIr1q9CBH-li_JL6oft-Dz2C3brJpX1f4lgOUSty62o6n65bCGVyeaAOjXzCb9AV9JchR55qySfmA2_-9d5tc_hkW80yd1c2xA6nMU8ScHeNmLdON2TiH7UHQKKXzq2IqopIaJfCY6BK-TctuslquqUIoUUjyWXe-a7DHpXC3aO88
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:51 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
decode_consent.js
static.smilewanted.com/js/decode_consent/ Frame A710 		48 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.smilewanted.com/js/decode_consent/decode_consent.js
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://csync.smilewanted.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:51 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
age
1152257
x-xss-protection
1; mode=block
referrer-policy
strict-origin
last-modified
Thu, 15 Apr 2021 17:11:55 GMT
server
cloudflare
etag
W/"607873db-c1ce"
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=315360000
cf-ray
7da682401fc46372-ORD
expires
Thu, 31 Dec 2037 23:55:55 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 9A8F 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202306140101&jk=1359602464023610&bg=!kJOlk8fNAAaGYqkwpmI7ADkAdvg8Wo74q-WbJR-38zjRxgDcS8tAKKi0Cz605HeIds82wzVqmOEYaKvEXwqNdRlG5E00YhafqooCAAAGc1IAAAADaAEHmQMaXC_CHTHV7S02gk4_-GMRnpN7iYGj0vPOrPJnCXrd0fHsazCy3Aqpuzm_9AKVq3v7fN_AtKvwMnwftlEfP8wjao3G3PrAUqYz5ia26_jwfllBdLHUVO9kLj-Zzurb7d_uTzUpD3TJkzjdaGsSrbrpR72qoHZag-XfiAp9mA7UV9tYpGOWEq2qkAKddn1kLTGeaNOXAQ9udZ0iNvM3N6q7NsQL2h1vR9_bFF9ge2k5fAnBuYDQT8OWN6rc-Lp_K59vjtE_6_k2RyDyP3H4TCYjuyrsXEtiGtHrodNSlFhVGwbITpNovQJDjGc5MISxPCQ4LZ-J3LfQKMTXOucSMu2ukKoWgr196mt40zt9JmmQTGgBliu13PS0rXnm2KM35FIiMNJDyDBJ1d3lyjgWGDhdUVXgTz_6v6tlCsGXkd0K3eKIso77Vp6QuUDTZG8W7eYJ5HYe6VIAOfXjYEL8cxuLcs_RCbd1sY3BVeDfablPurYQ6obaB96wXobgOq5kfaeWhFx-DsMCEkhRLNyE-la9dSD6abx6RndKvStwbiyLS-kmd6vvOi0q1mes5zBScosOnKyMR9LrEOHudwyTcCCos5nH4nl8xO8jcUJ3kDKDd3N07ARhePTElfvBIqA_HLX-aNAO2zw_o3wZUaiGJ8OzrgUTc1JX8uIIgC9aMMySgTwiCQwBDplsgTSgoXCpBB_Ul6Ay8RhcBjnKvwtTLdbZN9fjjzPN8neZvMSYxMrPqOskZdLwayxOTVoeA7DmqKPrxuieWJd9dLawKJhvnX-vBbqFm8xFfd00u7WWaMJ1KnzKiZO5lF67c5Z_3gt6gwRcl15uXlgoymef5YXRFW7CvGPCYFZzLxE4N4AL279zADIkxnyLofrKJQN8VVlpToxJcknpKScx8bbl4s_PUQjY4S-l0RuX2nMv7t1Z-cpB2r5uiBoFXSkqK9WjFYQDmrHMAkV6E0_EVRbKvDkKfn3hfHmVW1Cniw-sgud9Rpjo8xPsyFluU1NvJ1sZPOytM_Wi9q72fRlimg0yP4w7GIVUqZ1uoNqh417t4rU
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.mercurynews.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7EB8 		0
20 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2H9osAGSZJWXGNOSzwXA2IaoDgAAAAA4AeAEAg&bg=!7e6l7rrNAAaGYqkwpmI7ADkAdvg8Wl0pEosM9RPVNDcGtU6RtrT4UfZY2sSqLiDrfT4esqmqD3G_tmvgeI4Sn5YCSwUXnVCUP0cCAAACo1IAAAACaAEHCgAdHgPHIvCVn0heU-AC1XjTBXtPenKbxDWTdgTTdY-ZAw9O8reLYu2Mn2LpxCwrJ9tNjqjcr0qmRqOc_IoExcyifGedSNmXASE8Ab1J3ibTa3CdAvtZiGMvphE0cSnia7LVwAz8ZU-oOeHbXOwTzMDuecLPOFkC06ix-BEeiP_zdJk-DQK4oWRkw_ZbWY5vEqbAeT5IuALT0a6DFt3vJpbZaCQCMvWinwQpUOU_D3bD6hvQm4DiBzr_5o6b04f6wlxAHYfJCysp_V7u1GnLt01mU-NgYnSJfZZdyxLvo4ei6e67IeNfTd7Nl3Zi9WvkP4bfDDpMOMHgjuNzHkgLuHcXPhQhzWFnfO2LgxFMb_akBcOLOQ2acCuJETifCXnxpS3PuPbiLdhDS_6TeWyQlXdY2N8N8UY12U4_hRDlHh34BV8raMX4xBf7C3yzEfZ2eEpMbJ97PzeDwtXdl5xdH1_DASpZ4YsUIAxB1sUwkNfMzk1EEoTp4LnN2bcvbI4veAw9WQ3o5JwejjVgk23g5Wu743PI-xmiES_RjzetidW5-VP0O7NSE7KhZSttk3CKpfK2x3HlWuXeiXKmTpwnj1sGxkMMTOdz7rDDm4B8MYUH3VC4ej3sfwhIX-tUUd1cJZx_z6q6Dqjxkj0XDhx3NHC6_9CDj9j99issr8V2bLuDNu1rOAKlcEfFbS5JlpcBHzf6hCUxYfLnjRDoshi_PRo6KGqYHBiojL7u4T0txQzmsoolVvU5qEZcd_1LF6unF2M3vhuo7bp-Z-KJ2SPdAklVIMnjrFuK2sp9a7qFbS7iOCZdf6vrDdSQIhUegA8nVlP0_ck_3ex3RLBf6UDVsU0JoXiCtV9w5rleWT-ZBRF4XkcG4ELzN-Vw9iUGEayTyjvT0U10sCrNFTxiExMcdMHqFqd9TW43PrpddJZoS2-MqVuFPCFzVsb_kXdYfkuRveA71VRuup1W_R4yolfbxg-6NM4TP3hNXdHD_hq_udC_wtiIUoUEpjUo_4CXbDBhRjdoW6bB9pWlsovhKCUuXU7w9xBbdU0B7OGuYDnXI1Wo8waCSXFP-W2BFeslPQtC4fE
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2002 Flushing, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:51 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
drop_cookie_sw.php
csync.smilewanted.com/ Frame 4379 		0
746 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/drop_cookie_sw.php
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/?us_privacy=1---
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6824088246372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding
8e94c585-96a4-4941-b2e1-1zz1687290289
csync.smilewanted.com/set_partner_userid_get/richaudience/ Frame 4CE3
Redirect Chain
  • https://sync.richaudience.com/f7872c90c5d3791e2b51f7edce1a0a5d/?p=ns9qrKJLKD&consentString=&r=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Frichaudience%2F%5BPDID%5D
  • https://csync.smilewanted.com/set_partner_userid_get/richaudience/8e94c585-96a4-4941-b2e1-1zz1687290289
0
689 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/richaudience/8e94c585-96a4-4941-b2e1-1zz1687290289
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6824148e26372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:50 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/richaudience/8e94c585-96a4-4941-b2e1-1zz1687290289
server
nginx/1.14.1
x-powered-by
PHP/8.2.4
RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
csync.smilewanted.com/set_partner_userid_get/unruly/ Frame A5F4
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=smilewanted
  • https://pixel-sync.sitescout.com/dmp/pixelSync?nid=110&redir=https%3A%2F%2Fsync.1rx.io%2Fusersync3%2Fcentro%2F2069.66%2F%7BuserId%7D%3Fzcc%3D0%26sspret%3D1&rndcb=3172524110
  • https://sync.1rx.io/usersync3/centro/2069.66/08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341?zcc=0&sspret=1&rndcb=3172524110
  • https://sync.targeting.unrulymedia.com/csync/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005?redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Funruly%2FRX-0582ffcc-029a-4b6a-9d8a-cee...
  • https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
0
600 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6824209f16372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:51 GMT
ETag
RX0582ffcc029a4b6a9d8acee11ea1f0b8005
Location
https://csync.smilewanted.com/set_partner_userid_get/unruly/RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
P3P
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Server
Tengine
Transfer-Encoding
chunked
e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
csync.smilewanted.com/set_partner_userid_get/betweenx/ Frame C1F3
Redirect Chain
  • https://ads.betweendigital.com/match?bidder_id=45128&callback_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbetweenx%2F${USER_ID}
  • https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
0
112 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6824199826372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
location
https://csync.smilewanted.com/set_partner_userid_get/betweenx/e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
csync.smilewanted.com/set_partner_userid_get/bizzclick/ Frame 7C3A
Redirect Chain
  • https://us.ck-ie.com/smwt256.gif?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fbizzclick%2F%7B%24PARTNER_UID%7D
  • https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
0
615 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68241d9c46372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:51 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/bizzclick/7169e405081be3788037a33b4b5c5047dc8019fcafb3f4907d29900d6955067c
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
1235390588561432912
csync.smilewanted.com/set_partner_userid_get/adform/ Frame 1792
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fadform%2F%24UID
  • https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
0
913 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682429a9e6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:51 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/adform/1235390588561432912
server
nginx
%7BSTX_USER_ID%7D
csync.smilewanted.com/set_partner_userid_get/sharethrough/ Frame 3475
Redirect Chain
  • https://match.sharethrough.com/universal/v1?supply_id=GmfSCHMu&gdpr=0&gdpr_consent=
  • https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
0
575 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da682425a556372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:51 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/sharethrough/%7BSTX_USER_ID%7D?gdpr=0
953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
csync.smilewanted.com/set_partner_userid_get/smartyads/ Frame 0EE1
Redirect Chain
  • https://us.ck-ie.com/smw888.gif?gdpr=0&gdpr_consent=&us_privacy={$USPrivacy}&coppa={$COPPA}&puid={$PARTNER_UID}
  • https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
0
635 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68242cadf6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Date
Tue, 20 Jun 2023 19:44:51 GMT
Expires
0
Location
https://csync.smilewanted.com/set_partner_userid_get/smartyads/953bdbdbb23c534544e9c2d277e74dd44d60d2809daa97432e235d393c498a95
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
setuid
ib.adnxs.com/prebid/ Frame 92EA
Redirect Chain
  • https://csync.smilewanted.com/getuid?source=prebid-server&gdpr=0&gdpr_consent=&us_privacy=&redirect=https%3A%2F%2Fib.adnxs.com%2Fprebid%2Fsetuid%3Fbidder%3Dsmilewanted%26gdpr%3D0%26gdpr_consent%3D%...
  • https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
43 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.160.117 New York, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

AN-X-Request-Uuid
1ccd90dc-45d1-4ce1-baf8-e8cea8bc0da0
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
Date
Tue, 20 Jun 2023 19:44:52 GMT
Expires
Sat, 15 Nov 2008 16:00:00 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma
no-cache
Server
nginx/1.21.3
X-Proxy-Origin
149.56.153.187; 149.56.153.187; 676.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
X-XSS-Protection
0

Redirect headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68242cae46372-ORD
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
location
https://ib.adnxs.com/prebid/setuid?bidder=smilewanted&gdpr=0&gdpr_consent=&f=i&uid=592134c86483b2750921ac2e0977bcb6
server
cloudflare
connectmyusers.php
cdn.connectad.io/ Frame C9AA 		1 KB
864 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:8ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

age
1544
alt-svc
h3=":443"; ma=86400
cache-control
max-age=3600
cf-cache-status
HIT
cf-ray
7da68243be018c36-EWR
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
last-modified
Tue, 20 Jun 2023 19:19:07 GMT
server
cloudflare
vary
Accept-Encoding
4777538607685951564
csync.smilewanted.com/set_partner_userid_get/smart/ Frame 958B
Redirect Chain
  • https://sync.smartadserver.com/getuid?gdpr_consent=&nwid=2491&url=https://csync.smilewanted.com/set_partner_userid_get/smart/[sas_uid]
  • https://csync.smilewanted.com/set_partner_userid_get/smart/4777538607685951564
0
724 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/smart/4777538607685951564
Requested by
Host: csync.smilewanted.com
URL: https://csync.smilewanted.com/?us_privacy=1---
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://csync.smilewanted.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da68243bbbb6372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:51 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

content-length
0
date
Tue, 20 Jun 2023 19:44:51 GMT
location
https://csync.smilewanted.com/set_partner_userid_get/smart/4777538607685951564
1
sync-eu.connectad.io/syncer/ Frame B362 		4 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Requested by
Host: cdn.connectad.io
URL: https://cdn.connectad.io/connectmyusers.php?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:8ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
efb644893def9b62950c8cbc06a519bef65a85abe36999e3be17e4ae5093eb50

Request headers

Referer
https://cdn.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da682491c008c36-EWR
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 20 Jun 2023 19:44:52 GMT
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
server
cloudflare
vary
Accept-Encoding
1
sync.connectad.io/umatch/ Frame 81CB
Redirect Chain
  • https://creativecdn.com/cm-notify?pi=connectad
  • https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=RrG2QWcZ9j7dv54OJsuG&pi=connectad
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=RrG2QWcZ9j7dv54OJsuG&pi=connectad
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:8ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da6824ade008c36-EWR
date
Tue, 20 Jun 2023 19:44:53 GMT
server
cloudflare

Redirect headers

cache-control
no-cache, no-store, must-revalidate, private, max-age=0
content-length
0
date
Tue, 20 Jun 2023 19:44:52 GMT Tue, 20 Jun 2023 19:44:52 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://sync.connectad.io/umatch/1?bidder=rtbhouse&dataid=data6&uuid=RrG2QWcZ9j7dv54OJsuG&pi=connectad
pragma
no-cache
1
sync.connectad.io/umatch/ Frame 25C5
Redirect Chain
  • https://ap.lijit.com/pixel?redir=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dsovrn%26dataid%3Ddata12%26uuid%3D%24UID
  • https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgbPZHuyVpOjRtQ-i3ojE3
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgbPZHuyVpOjRtQ-i3ojE3
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:8ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da6824aadc88c36-EWR
date
Tue, 20 Jun 2023 19:44:53 GMT
server
cloudflare

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Content-Type
Access-Control-Allow-Methods
GET, POST, DELETE, PUT
Access-Control-Allow-Origin
*
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:52 GMT
Location
https://sync.connectad.io/umatch/1?bidder=sovrn&dataid=data12&uuid=G2VgbPZHuyVpOjRtQ-i3ojE3
X-Sovrn-Pod
ad_ap4ewr1
1
sync.connectad.io/umatch/ Frame 4AA5
Redirect Chain
  • https://cm.adform.net/cookie?redirect_url=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Dadform%26dataid%3Ddata4%26uuid%3D%24UID
  • https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1235390588561432912
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1235390588561432912
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:8ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da6824c2f848c36-EWR
date
Tue, 20 Jun 2023 19:44:53 GMT
server
cloudflare

Redirect headers

content-length
0
content-type
text/plain
date
Tue, 20 Jun 2023 19:44:52 GMT
location
https://sync.connectad.io/umatch/1?bidder=adform&dataid=data4&uuid=1235390588561432912
server
nginx
user_sync.html
ads.pubmatic.com/AdServer/js/ Frame 4A3B 		16 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.54.68.197 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-54-68-197.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
max-age=165949
content-encoding
gzip
content-length
5554
content-type
text/html
date
Tue, 20 Jun 2023 19:44:52 GMT
expires
Thu, 22 Jun 2023 17:50:41 GMT
last-modified
Fri, 16 Dec 2022 06:36:49 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
Apache
vary
Accept-Encoding
usermatch
ssum.casalemedia.com/ Frame 2DD1 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
9029197c97f9d383a5544803ea6e353f9b67bbaf6c385a9a8f38a0d1657a275d

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

Cache-Control
no-cache
Connection
Keep-Alive
Content-Length
1783
Content-Type
text/html
Date
Tue, 20 Jun 2023 19:44:52 GMT
Expires
0
Keep-Alive
timeout=1, max=500
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma
no-cache
Server
Apache
1
sync-eu.connectad.io/pixel/ Frame 12BB
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=rtaplus&user_id=WO8dHzCc5VwX4NQ47Y5w94la1DNoDjurpcn5rgPp&gdpr=0
  • https://sync.mathtag.com/sync/img?mt_exid=46&redir=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D80%26user_id%3D%5BUUID%5D%26expires%3D30%26ssp%3Drtaplus%26bsw_param%3D2491035f-3b91-450a-bf47-d3da43a3fb7...
  • https://x.bidswitch.net/sync?dsp_id=80&user_id=5f956492-01a9-4900-b96e-6cf0342c9990&expires=30&ssp=rtaplus&bsw_param=2491035f-3b91-450a-bf47-d3da43a3fb7b&gdpr=0&gdpr_consent=
  • https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync-eu.connectad.io/pixel/1?dataid=data3&uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:8ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da6824c2f868c36-EWR
date
Tue, 20 Jun 2023 19:44:53 GMT
server
cloudflare

Redirect headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 20 Jun 2023 19:44:52 GMT
Location
//sync-eu.connectad.io/pixel/1?dataid=data3&uuid=2491035f-3b91-450a-bf47-d3da43a3fb7b
Server
nginx
WO8dHzCc5VwX4NQ47Y5w94la1DNoDjurpcn5rgPp
csync.smilewanted.com/set_partner_userid_get/connectad/ Frame 32AD 		0
835 B 		Document
General
Check archive.org
Download Go to
Full URL
https://csync.smilewanted.com/set_partner_userid_get/connectad/WO8dHzCc5VwX4NQ47Y5w94la1DNoDjurpcn5rgPp
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.10.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
cf-cache-status
DYNAMIC
cf-ray
7da6824a4b026372-ORD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 20 Jun 2023 19:44:52 GMT
server
cloudflare
vary
Accept-Encoding
cm
u.openx.net/w/1.0/ Frame DF3F 		850 B
551 B 		Document
General
Check archive.org
Download Go to
Full URL
https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Requested by
Host: sync-eu.connectad.io
URL: https://sync-eu.connectad.io/syncer/1?gdpr_consent=&cb=https%3A%2F%2Fcsync.smilewanted.com%2Fset_partner_userid_get%2Fconnectad%2F
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
931b98e3bdd66e460202a85744656356cad4b1b41ecea51fc0869da7dc77cbae

Request headers

Referer
https://sync-eu.connectad.io/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
532
content-type
text/html
date
Tue, 20 Jun 2023 19:44:52 GMT
p3p
CP="CUR ADM OUR NOR STA NID"
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
via
1.1 google
1
sync.connectad.io/umatch/ Frame DF3F 		0
510 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.connectad.io/umatch/1?dataid=data5&uuid=1ddae3c5-60e9-4a29-94f8-d8c183e9375c
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:8ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:53 GMT
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7da6824a8dab8c36-EWR
alt-svc
h3=":443"; ma=86400
sd
us-u.openx.net/w/1.0/ Frame DF3F
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJIBqAABSFKRcAAz
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJIBqAABSFKRcAAz
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

x-served-by
cache-yul12829-YUL
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687290293.859098,VS0,VE0
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=ZJIBqAABSFKRcAAz
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
b0c30a4e-49da-eb89-cea3-0e21fde53898
pr-bh.ybp.yahoo.com/sync/openx/ Frame DF3F 		43 B
600 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/openx/b0c30a4e-49da-eb89-cea3-0e21fde53898?gdpr=0
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a01:1182:3903:eb81:31e2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:52 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
dcm
s.amazon-adsystem.com/ Frame DF3F 		43 B
855 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.amazon-adsystem.com/dcm?pid=6e1b1225-4dd8-4d7d-b277-465574a27014&id=7cd21077-c5dc-c23a-3f7a-9a436a813e31
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:52 GMT
Strict-Transport-Security
max-age=47474747; includeSubDomains; preload
Server
Server
x-amz-rid
NARWADMD765RPTJPX2FT
Vary
Content-Type,Accept-Encoding,User-Agent
Content-Type
image/gif
p3p
policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection
keep-alive
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame DF3F
Redirect Chain
  • https://match.adsrvr.org/track/cmf/openx?oxid=24046c0a-d976-79c0-ff74-18d402b2f5d1&gdpr=0
  • https://us-u.openx.net/w/1.0/sd?id=537072971&val=db51a350-c421-4780-94b8-db6155d007ec&ttd_puid=24046c0a-d976-79c0-ff74-18d402b2f5d1&gdpr=0&gdpr_consent=
43 B
62 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072971&val=db51a350-c421-4780-94b8-db6155d007ec&ttd_puid=24046c0a-d976-79c0-ff74-18d402b2f5d1&gdpr=0&gdpr_consent=
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://us-u.openx.net/w/1.0/sd?id=537072971&val=db51a350-c421-4780-94b8-db6155d007ec&ttd_puid=24046c0a-d976-79c0-ff74-18d402b2f5d1&gdpr=0&gdpr_consent=
content-type
text/html
cache-control
private,no-cache, must-revalidate
content-length
335
pixel
cm.g.doubleclick.net/ Frame DF3F 		170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MDg2YmJmYzAtMTAwMS0yNzY0LWVhOTQtNDI2ZGM4NTAzYmIx
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.34 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame DF3F
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAxm-FWt34UsFpBDa5fkU7Q&google_cver=1
43 B
61 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAxm-FWt34UsFpBDa5fkU7Q&google_cver=1
Requested by
Host: u.openx.net
URL: https://u.openx.net/w/1.0/cm?id=891039ac-a916-42bb-a651-4be9e3b201da&ph=a3aece0c-9e80-4316-8deb-faf804779bd1&gdpr=0&r=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata5%26uuid%3D%7BOPENX_ID%7D
Protocol
H3
Server
34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
218.64.98.34.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://u.openx.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAxm-FWt34UsFpBDa5fkU7Q&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 2DD1
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJIBqAABSFKRcAAz
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJIBqAABSFKRcAAz
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:52 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

x-served-by
cache-yul12829-YUL
pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
via
1.1 varnish
server
Varnish
x-timer
S1687290293.891060,VS0,VE0
x-cache
HIT
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=ZJIBqAABSFKRcAAz
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
crum
dsum-sec.casalemedia.com/ Frame 2DD1
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/ie
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAEDUk7JJAMAACROtOIu9g&expiration=1688499892
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAEDUk7JJAMAACROtOIu9g&expiration=1688499892
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:52 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAEDUk7JJAMAACROtOIu9g&expiration=1688499892
Date
Tue, 20 Jun 2023 19:44:52 GMT
strict-transport-security
max-age=2592000; includeSubDomains
Server
gunicorn
Connection
keep-alive
Content-Length
0
rum
dsum.casalemedia.com/ Frame 2DD1
Redirect Chain
  • https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1
  • https://casale-match.dotomi.com/match/bounce/current?DotomiTest=648cdd480c16184a&is_secure=true&networkId=19998&version=1
  • https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAHPMPxJ_kwXAMTA-5_AAAAAAA&expiration=1687376692&is_secure=true
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAHPMPxJ_kwXAMTA-5_AAAAAAA&expiration=1687376692&is_secure=true
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:53 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
server
nginx
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP NID OUR STP"
location
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=AAAHPMPxJ_kwXAMTA-5_AAAAAAA&expiration=1687376692&is_secure=true
cache-control
no-cache, private, max-age=0, no-store
content-length
0
expires
0
crum
dsum-sec.casalemedia.com/ Frame 2DD1
Redirect Chain
  • https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
  • https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703101493&external_user_id=4ed84149-74cb-4089-8a62-fd46691017b4
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703101493&external_user_id=4ed84149-74cb-4089-8a62-fd46691017b4
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:53 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=498
Content-Length
43
Expires
0

Redirect headers

date
Tue, 20 Jun 2023 19:44:53 GMT
via
1.1 google
access-control-allow-methods
GET,OPTIONS
content-type
text/html; charset=utf-8
access-control-allow-origin
*.casalemedia.com
location
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1703101493&external_user_id=4ed84149-74cb-4089-8a62-fd46691017b4
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
157
rum
dsum-sec.casalemedia.com/ Frame 2DD1
Redirect Chain
  • https://csync.loopme.me/?pubid=11466&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D24%26external_user_id%3D%7Bviewer_token%7D&us_privacy=&gdpr=&gdpr_consent=&gpp=&gpp_sid=
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=ff76b2fa-a2e6-48d5-8a14-13731d407294&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=ff76b2fa-a2e6-48d5-8a14-13731d407294&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:53 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=497
Content-Length
43
Expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=24&external_user_id=ff76b2fa-a2e6-48d5-8a14-13731d407294&gpp_sid=null&gpp=null&us_privacy=null&gdpr_consent=null&gdpr=null
date
Tue, 20 Jun 2023 19:44:53 GMT
server
_
content-length
0
rum
dsum-sec.casalemedia.com/ Frame 2DD1
Redirect Chain
  • https://sync.taboola.com/sg/indexscod/1/cm/?us_privacy=&gdpr=&gdpr_consent=&id=ZJIBqD7bZiR98t4YH35qSwAA%263485&gpp=&gpp_sid=
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
43 B
632 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
HTTP/1.1
Server
192.40.39.223 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:52 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=26&external_user_id=1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
date
Tue, 20 Jun 2023 19:44:52 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
27455
ZJIBqD7bZiR98t4YH35qSwAADZ0AAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame 2DD1 		43 B
600 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pr-bh.ybp.yahoo.com/sync/casale/ZJIBqD7bZiR98t4YH35qSwAADZ0AAAAB?gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:4e9:5a01:1182:3903:eb81:31e2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:52 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
tp_out
d.adroll.com/cm/index/ Frame 2DD1 		42 B
180 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/cm/index/tp_out?advertisable=3GMDZMBFQREVBC75SYYKWH
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:61c0:2204:b513:b8fc:2d8f:8df9 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
nginx/1.22.1 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:52 GMT
cache-control
no-transform,public,max-age=300,s-maxage=900
server
nginx/1.22.1
content-length
42
vary
Cookie
content-type
image/gif
1
sync.connectad.io/umatch/ Frame 2DD1 		0
490 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.connectad.io/umatch/1?bidder=idx&dataid=data13&uuid=ZJIBqD7bZiR98t4YH35qSwAA%263485
Requested by
Host: ssum.casalemedia.com
URL: https://ssum.casalemedia.com/usermatch?s=190906&cb=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fbidder%3Didx%26dataid%3Ddata13%26uuid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:8ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://ssum.casalemedia.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:53 GMT
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7da6824addfc8c36-EWR
alt-svc
h3=":443"; ma=86400
1
sync.connectad.io/umatch/ Frame F11B 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.connectad.io/umatch/1?dataid=data1&uuid=479CC621-B2E0-490D-8915-42055EBBC0EB
Requested by
Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156077&predirect=https%3A%2F%2Fsync.connectad.io%2Fumatch%2F1%3Fdataid%3Ddata1%26uuid%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:8ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://ads.pubmatic.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, post-check=0, pre-check=0, private
cf-cache-status
DYNAMIC
cf-ray
7da6824abddd8c36-EWR
date
Tue, 20 Jun 2023 19:44:53 GMT
server
cloudflare
event.png
tpsc-ue1.doubleverify.com/ Frame 8B22 		0
234 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tpsc-ue1.doubleverify.com/event.png?impid=7ba64b300daa4795b52937184a0916ff&flavor=0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&vdur=107&eoid=14&msrjs=3941&sdf=67108870&vit=2&isvelg=1&rmi=16&tltms=24&tetms=28&msltms=26&vltms=107&sei=290&vetms=539&tuviims=691&tuviems=1337&engms=1&engisel=1&dvp_dtcov=4&msrcanlm=394&msrcannum=4&ee_dp_tmads=2761&ismms=22&isumms=21&nvr=6&elmtp=3&isbxdms=2722&b0=100&b11=2829&adhgt=250&adwdth=300&norwdth=300&norhgt=250&vsos=4&dvp_vsosnmr=16&lftb=2929&sftb=2929&msrdp=4&naral=2&vct=512&vphgt=1200&vpwdth=1600&chgt=250&cwdth=300&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=1099&isuiabvms=1099&ispmxpms=1099&engalms=21&engscrlms=421&dvp_pageEng=true&dvp_dpr=1&vstsz=755&ee_dp_cvcmeeid=1&metp=1&meeid=1&ttfurm=3659&cbust=1687290292959635
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:53 GMT
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Expires
06/19/2023 19:44:53
event.png
tpsc-ue1.doubleverify.com/ Frame 3D75 		0
234 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://tpsc-ue1.doubleverify.com/event.png?impid=7d4ab4062f9a489a9510df9ad5a80891&flavor=0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&vdur=49&eoid=14&msrjs=3941&sdf=67108870&vit=2&isvelg=1&rmi=16&tltms=33&tetms=13&msltms=89&vltms=49&sei=290&vetms=250&tuviims=573&tuviems=872&engms=1&engisel=1&dvp_dtcov=4&msrcanlm=394&msrcannum=4&ee_dp_tmads=2420&ismms=24&isumms=23&nvr=6&elmtp=3&isbxdms=2324&b0=100&b11=2466&adhgt=250&adwdth=300&norwdth=300&norhgt=250&vsos=4&dvp_vsosnmr=16&lftb=2566&sftb=2566&msrdp=2&naral=2&vct=512&vphgt=1200&vpwdth=1600&chgt=250&cwdth=300&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=961&isuiabvms=961&ispmxpms=961&engalms=23&engscrlms=207&dvp_pageEng=true&dvp_dpr=1&vstsz=756&ee_dp_cvcmeeid=1&metp=1&meeid=1&ttfurm=3312&cbust=1687290293404621
Requested by
Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements3941.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Pragma
no-cache
Date
Tue, 20 Jun 2023 19:44:53 GMT
Cache-Control
max-age=0
Access-Control-Allow-Credentials
true
Connection
keep-alive
Expires
06/19/2023 19:44:53
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 7C4E 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:53 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:53 GMT
syncframe
gum.criteo.com/ Frame 63E8 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:53 GMT
server
Kestrel
server-processing-duration-in-ticks
4197186
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 7C4E 		88 KB
29 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:53 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:53 GMT
sid
mug.criteo.com/ Frame 63E8
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=0&topUrl=www.mercurynews.com&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=Dt5YhXw2cEp1ZTd2ZTVQTS9teHBzRk9DK2cwMUZzbkptL2h0dlBJNTJNTTVBYk5MZTVja1I4bk9uRzlBU0l4dXZqYUg0ZjBtN3Q0SHJrKzRsSXFnZUZxdENqQmQ1Rzl2bE9PRFBSK3ZHQWZPM2JrY3pucHZBYjVsb3JqZF...
425 B
645 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=Dt5YhXw2cEp1ZTd2ZTVQTS9teHBzRk9DK2cwMUZzbkptL2h0dlBJNTJNTTVBYk5MZTVja1I4bk9uRzlBU0l4dXZqYUg0ZjBtN3Q0SHJrKzRsSXFnZUZxdENqQmQ1Rzl2bE9PRFBSK3ZHQWZPM2JrY3pucHZBYjVsb3JqZFM2WThzV1lWUm5YcUppL08zdUJtZ3JORHppVm1jQVlaMEZjWDBzK0xraVk5OHZMTHdEc0dJWTRnaXFvbllMbGV6bmY5WUJvaUlKOWJtazg5SEhzU2xhbFBoVmtXekdlRmVwRVZyVndnaXN4SVdpYXNYMWFRV0kzb2NaVlRwakdNa1VHYjhjRUtCUm0rUXhld1pZR090a0E1aUdNUVJ5citqeTBpUDJjaDN6YzRNZVpDQ2dCUT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
da87c0b95502e71544771d277a27553b58d068d774841511d45b7f262b17b564
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:53 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
868871
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:53 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=Dt5YhXw2cEp1ZTd2ZTVQTS9teHBzRk9DK2cwMUZzbkptL2h0dlBJNTJNTTVBYk5MZTVja1I4bk9uRzlBU0l4dXZqYUg0ZjBtN3Q0SHJrKzRsSXFnZUZxdENqQmQ1Rzl2bE9PRFBSK3ZHQWZPM2JrY3pucHZBYjVsb3JqZFM2WThzV1lWUm5YcUppL08zdUJtZ3JORHppVm1jQVlaMEZjWDBzK0xraVk5OHZMTHdEc0dJWTRnaXFvbllMbGV6bmY5WUJvaUlKOWJtazg5SEhzU2xhbFBoVmtXekdlRmVwRVZyVndnaXN4SVdpYXNYMWFRV0kzb2NaVlRwakdNa1VHYjhjRUtCUm0rUXhld1pZR090a0E1aUdNUVJ5citqeTBpUDJjaDN6YzRNZVpDQ2dCUT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
313324
content-length
0
expires
0
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame E61A 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:53 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:53 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 9134 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:53 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:53 GMT
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 1974 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:53 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:53 GMT
syncframe
gum.criteo.com/ Frame BD9E 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:53 GMT
server
Kestrel
server-processing-duration-in-ticks
629581
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
publishertag.prebid.130.js
static.criteo.net/js/ld/ Frame 8B0C 		88 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/publishertag.prebid.130.js
Requested by
Host: hb.adpone.com
URL: https://hb.adpone.com/prebid7.19.0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
nginx /
Resource Hash
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sopalk.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 19:44:53 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 06 Apr 2023 09:15:30 GMT
server
nginx
etag
W/"642e8db2-16124"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Wed, 21 Jun 2023 19:44:53 GMT
syncframe
gum.criteo.com/ Frame CE58 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:53 GMT
server
Kestrel
server-processing-duration-in-ticks
664978
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
syncframe
gum.criteo.com/ Frame 8693 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:52 GMT
server
Kestrel
server-processing-duration-in-ticks
1393485
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
sid
mug.criteo.com/ Frame BD9E
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=2&topUrl=www.mercurynews.com&bundle=VYhnal9RVGZMOUkxWGRNRHlHcHFhYnU5ZyUyRkxjWmcyQnFiVnRaZDlVVjBUcFlRaUQ5N...
  • https://mug.criteo.com/sid?cpp=hd-KdnwyNy9xY285a0JsWFRmUGJOdEJmdEx6ZDBoTDQvL2tPQXNrSzN0ZmowYnAwSitScnVaOGlOdVFzOHhiaXA5WEhrOWVBLzQ1bEFHTGxCak5yRUNCSzBoNERtRTRRRGUzK3hSQWlxTUFFZlZrMmtjSTNSMWF6OWxPL2...
425 B
647 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=hd-KdnwyNy9xY285a0JsWFRmUGJOdEJmdEx6ZDBoTDQvL2tPQXNrSzN0ZmowYnAwSitScnVaOGlOdVFzOHhiaXA5WEhrOWVBLzQ1bEFHTGxCak5yRUNCSzBoNERtRTRRRGUzK3hSQWlxTUFFZlZrMmtjSTNSMWF6OWxPL2lnbk5TN0hyQUVQK0IrUlMvNVFQTEFaakdSZW1YQnovODcxOWViZTNmaG83VHBFc1F4eklZajZRaWpWcmozb1dxQU5qeTdMM09ST2Z6TEYwN1NVUzl6SGZ5N2NPb095amdaL3poUlJ0N3N6bnRVMithMk9LVnpyVkF0bm10Snl3T3RKNUZzMS9KaEdIUEVHbmRGZDFQQ1JoTW5PeTk1SjFkVGpxNm5oMkVuSFAvU0FjMEpRaz18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
6cc7914bdafe0f7f59505140771131cbd08dcc02bd5b8d5eb97cae4ef7ec99ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:53 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
817380
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:53 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=hd-KdnwyNy9xY285a0JsWFRmUGJOdEJmdEx6ZDBoTDQvL2tPQXNrSzN0ZmowYnAwSitScnVaOGlOdVFzOHhiaXA5WEhrOWVBLzQ1bEFHTGxCak5yRUNCSzBoNERtRTRRRGUzK3hSQWlxTUFFZlZrMmtjSTNSMWF6OWxPL2lnbk5TN0hyQUVQK0IrUlMvNVFQTEFaakdSZW1YQnovODcxOWViZTNmaG83VHBFc1F4eklZajZRaWpWcmozb1dxQU5qeTdMM09ST2Z6TEYwN1NVUzl6SGZ5N2NPb095amdaL3poUlJ0N3N6bnRVMithMk9LVnpyVkF0bm10Snl3T3RKNUZzMS9KaEdIUEVHbmRGZDFQQ1JoTW5PeTk1SjFkVGpxNm5oMkVuSFAvU0FjMEpRaz18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
472320
content-length
0
expires
0
sid
mug.criteo.com/ Frame CE58
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=2&topUrl=www.mercurynews.com&bundle=VYhnal9RVGZMOUkxWGRNRHlHcHFhYnU5ZyUyRkxjWmcyQnFiVnRaZDlVVjBUcFlRaUQ5N...
  • https://mug.criteo.com/sid?cpp=jtnSFXxSSG5DM0IrNEQ1M25nOFZPTENhNm1WUEJZTnRSRWRCeUFpRG9nTFIwcTE4clhhNGpPUUh1bzFEcktFRG4yNTZXeTVub2twZ3JUKzJreHA3QSs5NUlLV3pYQnFyS1BVN3FlbWppRm9FQWN5ek5iclc5bFdOSWtLam...
422 B
647 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=jtnSFXxSSG5DM0IrNEQ1M25nOFZPTENhNm1WUEJZTnRSRWRCeUFpRG9nTFIwcTE4clhhNGpPUUh1bzFEcktFRG4yNTZXeTVub2twZ3JUKzJreHA3QSs5NUlLV3pYQnFyS1BVN3FlbWppRm9FQWN5ek5iclc5bFdOSWtLam13NUcramZZNC9PTllOSjhsYm5Mb0EvSThQRElNNEM0U3hJTm1LQlVFL0Q0cW1qSGVsYndkWTI3d3puYTJVd0ltSGpjUVRpZ21jTWJ0LzZ0bTFXdlVIODVHL2dUVzV3Z2J1YnhVVXdINlQwRzMyVlZFQURGWi9TcXJZSkJaaWhMS0p1aUdxUVIwbElsZDQvVFdIS2hGVkd0anVjZ21Gb2oxbHdlT0pUS2VLQTVMdWtCNGFtYz18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
b699550edacfe847212b1149dd031f2f48217c87fcc183c2726a6277ad8288ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:53 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
822308
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=jtnSFXxSSG5DM0IrNEQ1M25nOFZPTENhNm1WUEJZTnRSRWRCeUFpRG9nTFIwcTE4clhhNGpPUUh1bzFEcktFRG4yNTZXeTVub2twZ3JUKzJreHA3QSs5NUlLV3pYQnFyS1BVN3FlbWppRm9FQWN5ek5iclc5bFdOSWtLam13NUcramZZNC9PTllOSjhsYm5Mb0EvSThQRElNNEM0U3hJTm1LQlVFL0Q0cW1qSGVsYndkWTI3d3puYTJVd0ltSGpjUVRpZ21jTWJ0LzZ0bTFXdlVIODVHL2dUVzV3Z2J1YnhVVXdINlQwRzMyVlZFQURGWi9TcXJZSkJaaWhMS0p1aUdxUVIwbElsZDQvVFdIS2hGVkd0anVjZ21Gb2oxbHdlT0pUS2VLQTVMdWtCNGFtYz18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
601774
content-length
0
expires
0
sid
mug.criteo.com/ Frame 8693
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=2&topUrl=www.mercurynews.com&bundle=VYhnal9RVGZMOUkxWGRNRHlHcHFhYnU5ZyUyRkxjWmcyQnFiVnRaZDlVVjBUcFlRaUQ5N...
  • https://mug.criteo.com/sid?cpp=GS-4jXxUaTVua2l1V0RYaXpFbURXaTlvRUlZdWE2ZW9MblhOQjNxWEtEMDVlNndDWFQ1cmhMbGI3SzRWellFaGJkZDd0VUYyMzFvOHViWFgrb2Z1UXE2UjBCN3ZoQzFrN1BxOWlJUHVFd1p6VkRMTExZUEtZdGdxdUtucF...
443 B
654 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=GS-4jXxUaTVua2l1V0RYaXpFbURXaTlvRUlZdWE2ZW9MblhOQjNxWEtEMDVlNndDWFQ1cmhMbGI3SzRWellFaGJkZDd0VUYyMzFvOHViWFgrb2Z1UXE2UjBCN3ZoQzFrN1BxOWlJUHVFd1p6VkRMTExZUEtZdGdxdUtucFJ2bk9NT3VZL1o5TXUrMlA2akZXcWo0R3pXa3RWQ0ZSeTE4Y2JKMFNicjRGTFpCbjRyM2hKSG9nQmdIUHRFYTFjQ01GalhiQUxZcE5HZk5JS0ZyeDluaXJsYWtGZzc0TWVLOXhBMkhERFRPSG9vWXh4NmQ1R0lwbllkdFRFUFRCY1J2SUw3QUhudTZOenJsQkVrQmlZZkpjTzhzMjdPZnNQL1ZGM2xoTGZlTXpENGhmaTUxRT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
29f9c2a86df189e26724a899022d938c2c86c55dfeda4d9d5392a3afefa6e9fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:52 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
3400071
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:53 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=GS-4jXxUaTVua2l1V0RYaXpFbURXaTlvRUlZdWE2ZW9MblhOQjNxWEtEMDVlNndDWFQ1cmhMbGI3SzRWellFaGJkZDd0VUYyMzFvOHViWFgrb2Z1UXE2UjBCN3ZoQzFrN1BxOWlJUHVFd1p6VkRMTExZUEtZdGdxdUtucFJ2bk9NT3VZL1o5TXUrMlA2akZXcWo0R3pXa3RWQ0ZSeTE4Y2JKMFNicjRGTFpCbjRyM2hKSG9nQmdIUHRFYTFjQ01GalhiQUxZcE5HZk5JS0ZyeDluaXJsYWtGZzc0TWVLOXhBMkhERFRPSG9vWXh4NmQ1R0lwbllkdFRFUFRCY1J2SUw3QUhudTZOenJsQkVrQmlZZkpjTzhzMjdPZnNQL1ZGM2xoTGZlTXpENGhmaTUxRT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
296707
content-length
0
expires
0
syncframe
gum.criteo.com/ Frame 6D71 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?origin=publishertag&topUrl=www.mercurynews.com&gdpr=0&gdpr_consent=
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.130.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2620:100:a001::c , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://sopalk.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 19:44:53 GMT
server
Kestrel
server-processing-duration-in-ticks
2733708
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
sid
mug.criteo.com/ Frame 6D71
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=publishertag&domain=sopalk.com&sn=ChromeSyncframe&so=2&topUrl=www.mercurynews.com&bundle=VYhnal9RVGZMOUkxWGRNRHlHcHFhYnU5ZyUyRkxjWmcyQnFiVnRaZDlVVjBUcFlRaUQ5N...
  • https://mug.criteo.com/sid?cpp=5f6G6nxOdit3aENZTWM4NmNjdVQ0aVFRQms3bXV0ajBrMTNvc3RsZzdjUmVqRGwyQWMreVpPL3N2RU1ZNjhVZktPZldzYjBYT0ozODl0aWx5MUM1S2kwalVGTXlDUFVCMEt6Rkcyc1BWRmd0VkZMZElQS1pCUkhQK3plOG...
433 B
652 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=5f6G6nxOdit3aENZTWM4NmNjdVQ0aVFRQms3bXV0ajBrMTNvc3RsZzdjUmVqRGwyQWMreVpPL3N2RU1ZNjhVZktPZldzYjBYT0ozODl0aWx5MUM1S2kwalVGTXlDUFVCMEt6Rkcyc1BWRmd0VkZMZElQS1pCUkhQK3plOGRDQzkyUkJXK2JGVVJsWTNkMG5YcEtiNDJUcS9FNUVpSVJDZjRJaFJOSmw2aDkxbzdJSkFqcjhrS2FLVnRRRW13bEppK05yelhRZU53eUNVVTYwQjlGMVV4dGxSTTlTeHpOYWFlN2xYb3lNSnBsRlF2N2tJZ0wvUXR0VGlxaTduRzk0ellTSDFja2w4QnlJZHJoSktobm9MbFZuakpmcDRjeFROV0ZTZmxvVnNaR0NTd2QxWT18&cppv=2
Protocol
H2
Server
74.119.119.139 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
c336ddb640bc4214acc849ac9bc3f69f05cecfabb245e18674b46a089ea1313c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:53 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1510961
expires
0

Redirect headers

pragma
no-cache
date
Tue, 20 Jun 2023 19:44:53 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=5f6G6nxOdit3aENZTWM4NmNjdVQ0aVFRQms3bXV0ajBrMTNvc3RsZzdjUmVqRGwyQWMreVpPL3N2RU1ZNjhVZktPZldzYjBYT0ozODl0aWx5MUM1S2kwalVGTXlDUFVCMEt6Rkcyc1BWRmd0VkZMZElQS1pCUkhQK3plOGRDQzkyUkJXK2JGVVJsWTNkMG5YcEtiNDJUcS9FNUVpSVJDZjRJaFJOSmw2aDkxbzdJSkFqcjhrS2FLVnRRRW13bEppK05yelhRZU53eUNVVTYwQjlGMVV4dGxSTTlTeHpOYWFlN2xYb3lNSnBsRlF2N2tJZ0wvUXR0VGlxaTduRzk0ellTSDFja2w4QnlJZHJoSktobm9MbFZuakpmcDRjeFROV0ZTZmxvVnNaR0NTd2QxWT18&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
293853
content-length
0
expires
0
sync
us-match.taboola.com/ Frame 3D12 		5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://us-match.taboola.com/sync?dast=V8IVYCLAYki4IjLRbgOhJIFgVHWizAdSwAAABgYID-AIkZl7uJYTFzi2Y201q08YzcEodltBZ5DIORc-SyOGc2IyAx43I3MSxmbtHMZlqLNp6RW-KwjNYij2Ewco5cFufMZgUfxnKZDGqBhGX2-w4KyunpMbsMoqLrbbE7nGbPGwQKoul0-Fz3et3vd1e7LB_X5Xl3-T53jd_tlwwmm71gtpcM9mqXz-iwu9UOy9fscqsclrvL5Fb7LS-36Oiwu0VHl1v3cnntJrfMb3lLXZ_TWzFZC_2uy-et-1u-bpXxrTn8TU-b860yvjxu0cts9rwlFo9fDgAAAAAe_P___0MAAAAAiAAAAAAgAQAAAIBCQIV_CwIXAAAAADD8____awAw2SAQHXJAaL_ddHk5zP4AAAAAAAIAAACABABCy3MJgJeRzBP__________zEG6DNvZPz____fUOgB8OAD4EEIAADAxZDD4iChiCv3HiIEZUUYAQAAAKjEydw9MkknqFhU-f__77cCcAUAIABR20qOKYvuoMRbGAAAAIIxC_Sw-P1mh13jd7vM_________7-Z_zP_aIRq6ofTCE-i2Kv5BQQAWPMLCADARt0AALwJgBN0CFoxGKxOQMwOAAAAwJ3___9_PSBjc_iGm8XC4rKZJs7dxOPxbQa73cQ5GexmnsVse5zBJ5VTLaSk-oQIy-z3HRSU09NjdhlERdfbYnc4zZ6D-KBhWE4GwfxM2GK0mkw2y-FsuZgMhqPhaLQ_A7EYDdBEDJbLyWQx2a1Gq9FmuBvNBgskEIMJomjRYLIajSaLyXA1mqxmy8Vut0EUrVrNRpvBcDWbzHa71XAwXI5GaMIWo9VkslkOZ8vFZDAcDUejIYKJic0zM0yGa5VhNluLJhPbWjgZLdzKkWO1nM2GK5dvtRa9PqaLcWLcTWZbJBiwuBfJ0yKdCEeG4WplXI5si93M4XJOlouVceYYuWyj1WRlsU3EEs3JIp3ILvuOzeEbbhYLi8tmmjh3E4_HtxnsdhPnZLCbeRazfWNi88wMk-FaZZjN1qLJxLYWTkYLt3LkWC1ns-HK5VutRa-P6WKcGHeT2b4xG-4my8FkN9w3ZsPdZDmY7Ib7Dp3hu_qcjdLJUuzRqVbLyEtncxoULoPFu1KdVtqC5KDNXkVOl2amLOqMfr_f7_f7_X6_32_Qeg5mg8L3XH7Ft8W2uv49KwexQaGIJYKLdKJ2mZwOu8v3-Vn-rsNb7bJ8XJfn3eX7XMQSpekineglg8lmL5jtJYO92uUzOuxutcPyNbvcKofl7jK51X7Lyy06Ouxu0dHl1r1cXrvJLfNb3lLX5_RWTNZCv-vyeev-lq9bZXxrDn_T0-Z8q4wvj1v0Mps9b4nFYxFLBKeLdCJ6GU8X9R85xGg5V83mitVmrhjuVgkAAAAAAAAAwBJMMt0EAAAAwMmgNrPBYrVOBzMYLjeD1XIBVKjX6Prh7aVramey2VVfddG47ekFX6yxxzTaZXI67C7f52f5uw5vtcvycV2ed5fvc2UAFek_zDb7jCDWarWsAQAACGADAAAI4KYbbwLRobj_____cQAAAADk0AMAAKDfB5SkGX7kSrH3D0CFWKvV6nZjrVYL!&excid=22&docw=0&cijs=1&nlb=false
Requested by
Host: cmp.osano.com
URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.48 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
7a77391b2332418f65e80772100bbc84f32dc73e799f3a8ca802927422024238

Request headers

Referer
https://www.mercurynews.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

content-type
text/html;charset=ISO-8859-1
date
Tue, 20 Jun 2023 19:45:00 GMT
machineid
3106
server
nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768236&size_id=15&alt_size_ids=9%2C10%2C54&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=ad84d507-3304-4eb1-b802-823505a908ec&l_pb_bid_id=4c8df310a0f9ee&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=ad84d507-3304-4eb1-b802-823505a908ec&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&slots=1&rand=0.9979962081309603
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzAweDUw&v=5&s=v31h3d5cv7e&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=4402421&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekF3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMDAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6OTcweDI1MA==&v=5&s=v31h3d5cvb6&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=1955090&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZPVGN3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyNTI4NjM2ODc2LCJ3IjoiOTcwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzIweDUw&v=5&s=v31h3d5d0k0&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=4037879&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekl3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMjAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6NzI4eDkw&v=5&s=v31h3d5d0n7&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=4671651&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZOekk0ZURrdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiI3MjgiLCJoIjoiOTAifSwid3IiOjJ9
Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=%2F21671350435%2C208595991%2F300x250-mercurynews.com&tk_flint=pbjs_lite_v7.19.0&x_source.tid=c6eb2f02-bfe4-430f-8e92-0303397074f8&l_pb_bid_id=465ed000c0be04&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.03587594882470024
Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283232&tk_flint=pbjs_lite_v7.19.0&x_source.tid=1c0725b7-bbae-4f71-a79e-c9e9820d946e&l_pb_bid_id=486b583cd1b4f9&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.3436870005164454
Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283237&tk_flint=pbjs_lite_v7.19.0&x_source.tid=f81d3ba0-e40c-439d-a5ee-69fa1144b012&l_pb_bid_id=103c28b99e5f1fb&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5918013549765238
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzIweDUw&v=5&s=v31h3d5d1ji&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=6954383&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekl3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMjAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283244&tk_flint=pbjs_lite_v7.19.0&x_source.tid=a1a3b79f-3b5e-44ff-a7d1-0fccf3307aee&l_pb_bid_id=12ee1680f1af3b1&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.13947838485035424
Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283247&tk_flint=pbjs_lite_v7.19.0&x_source.tid=0db98821-01a7-4eb3-9efe-36458cad46c4&l_pb_bid_id=12ce8a2816ff053&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7775279640995427
Domain
fastlane.rubiconproject.com
URL
https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283241&tk_flint=pbjs_lite_v7.19.0&x_source.tid=b20193e2-91b2-4a34-8ded-ca4ad5c8f749&l_pb_bid_id=63673bb9c18d17&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.034117453226497396
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6OTcweDkw&v=5&s=v31h3d5d2om&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=5569616&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZPVGN3ZURrdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiI5NzAiLCJoIjoiOTAifSwid3IiOjJ9
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6OTcweDI1MA==&v=5&s=v31h3d5d3nr&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3RvcF9sZWFkZXJib2FyZCIsInkiOjAsImNvIjowLCJzIjoiaHRsYWQtMy1ncHQifX0%3D&cb=401878&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZPVGN3ZURJMU1BPT0iLCJ3ZCI6eyJvIjoyNTI4NjM2ODc2LCJ3IjoiOTcwIiwiaCI6IjI1MCJ9LCJ3ciI6Mn0=
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/log
Domain
protected-by.clarium.io
URL
https://protected-by.clarium.io/pixel?tag=wt_M0l5UTgxV25uLWQ2YmllUUx1V2VEdU40UFdNLzI1Mjg2MzY4NzY6MzIweDUw&v=5&s=v31h3d5d3t2&id=eyJkZnAiOnsiYWQiOjM1NjI5OTM0LCJjIjpudWxsLCJsIjowLCJvIjoyNTI4NjM2ODc2LCJBIjoiLzgwMTMvbWVyY3VyeW5ld3MuY29tL3RoaW5ncy10by1kby9lbnRlcnRhaW5tZW50L3Nwb25zb3JzaGlwXzEiLCJ5IjowLCJjbyI6MCwicyI6Imh0bGFkLTEtZ3B0In19&cb=7107739&h=www.mercurynews.com&d=eyJ3aCI6Ik0wbDVVVGd4VjI1dUxXUTJZbWxsVVV4MVYyVkVkVTQwVUZkTkx6STFNamcyTXpZNE56WTZNekl3ZURVdyIsIndkIjp7Im8iOjI1Mjg2MzY4NzYsInciOiIzMjAiLCJoIjoiNTAifSwid3IiOjJ9
Domain
cdn.8proof.com
URL
https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-800.woff2
Domain
cdn.8proof.com
URL
https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-600.woff2
Domain
ice.360yield.com
URL
https://ice.360yield.com/match?publisher_dsp_id=313&dsp_callback=1&external_user_id=ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F286%2F916%2F1%2F9.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=

Verdicts & Comments Add Verdict or Comment

418 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| 16 object| 17 object| 18 object| 19 object| 20 object| 21 object| 22 object| 23 object| 24 object| 25 boolean| credentialless object| onbeforetoggle object| onscrollend object| scriptHelpers function| loadCSS object| _wpemojiSettings object| twemoji object| wp object| htlbid object| MNG_SSO_CONNEXT_EVENT_TIMING_ANALYTICS number| MNG_SSO_TOOLS_GLOBAL_START_TIME function| $ function| jQuery object| MG2 function| PluginInitOverride object| MG2Loader string| loaderVersion string| loaderBuild object| appInsights object| deferredResources function| blmGetIcon object| google function| reactiveElementPolyfillSupport object| reactiveElementVersions object| module$contents$mapsapi$overlay$overlayView_OverlayView function| createAuth0Client function| Auth0Client object| default_gsi object| authentication_config object| entitlements_config object| regeneratorRuntime function| simpleEmailValidation function| validatePhoneNumber object| MNGAuthentication boolean| disableAuth0AuthFlow function| backToStory object| PushlySDK object| dfm_pushly_options object| blueConicPreListeners function| BCClass object| blueConicClient function| Osano function| __gpp function| __tcfapi function| __uspapi function| mg2WidgetAPI object| DFM_AD_MODS_LEVEL object| DFM_AD_MODS_DEBUG object| article_config object| _taboola function| analyticsEvent function| analyticsSocial function| analyticsVPV function| analyticsClearVPV function| analyticsForm object| dataLayer function| closeMobileAdhesionAd function| keyboardHandler object| bloom_meta string| bloom_domain function| blmInit function| blmKeyUp function| blmTrigger function| blmMapLaunch function| blmMapClose function| blmGetMetadata object| bloom_nns boolean| bloom_nns_cookies_enabled object| bloom_nns_remote number| bloom_nns_remote_delay number| bloom_nns_iv_pulse boolean| bloom_amp function| blmSearchInit function| blmSearchLoad function| blmSearchLaunch function| blmSearchInitWindow function| blmSearchIconAction function| blmSearchKeyUp function| blmSearchOpen function| blmSearchClose function| blmSearchGeolocation function| blmSearchGeolocationResponse function| blmSearchLoadRemoteContent function| blmSearchSetLayout function| blmSearchGetLayout function| blmSearchUrlRequest function| blmSearchUrlParamParse function| blmSearchUrlParamModify function| blmSearchSupports function| blmSearchGetUserDistance function| blmSearchSetCookie function| blmSearchGetCookie function| blmSearchDeleteCookie object| runtime object| picturefillCFG function| picturefill object| lazySizesConfig object| lazySizes function| setImmediate function| clearImmediate object| wpParselyHooks object| PARSELY function| _typeof boolean| dfmCanRunAds object| webpackChunkknowlton function| Headroom function| Hammer object| dfm_viafoura_options object| vfQ object| _stq object| AI object| Microsoft function| __extends function| _endsWith object| TRC object| _tblConsole string| pm_pgtp undefined| msg object| _comscore boolean| htlbidLoaded object| pbjsChunk object| pbjs object| _pbjsGlobals function| HTLBIDLoader object| googletag object| apstag object| bc_json209 object| bc_json208 object| google_tag_manager object| google_tag_data object| litHtmlVersions object| ggeac object| google_js_reporting_queue function| st_go function| linktracker_init object| wpcom object| closure_lm_396776 object| bloom_nns_el_button_current object| bloom_nns_el_button_current_label object| bloom_nns_el_header object| bloom_nns_el_header_title object| bloom_nns_el_header_landscape object| bloom_nns_el_header_landscape_balls object| bloom_nns_el_header_landscape_ball object| bloom_nns_el_content object| bloom_nns_el_content_local object| bloom_nns_el_content_local_banner object| bloom_nns_el_content_local_banner_text object| bloom_nns_el_content_local_banner_close object| bloom_nns_el_content_remote object| bloom_nns_el_content_local_intro object| bloom_nns_el_content_local_intro_title object| bloom_nns_el_content_local_intro_options object| bloom_nns_el_content_local_intro_options_button object| bloom_nns_el_content_local_intro_options_search object| bloom_nns_el_content_local_intro_options_search_input object| bloom_nns_el_content_local_intro_options_search_button object| bloom_nns_el_footer object| bloom_nns_el_footer_attribution object| bloom_nns_el_footer_arrow object| bloom_nns_el_footer_arrow_inner object| __G_ID_CLIENT__ object| webVitals string| GoogleAnalyticsObject function| ga string| comscoreID object| _qevents string| ssaUrl object| _rmxd object| vfConfig object| _aps boolean| apstagLOADED function| __trcCopyProps function| __trcFromError function| __trcClientTimestamp function| __trcLog function| __trcError function| __trcDebug function| __trcInfo function| __trcWarn function| __trcWarnUsingBeacon function| __trcDOMWalker function| __trcJSONify function| __trcUnJSONify function| __trcTrim function| __trcGetElementsByClass function| __trcToArray function| __trcObjectCreate function| PageManager function| addHashParam number| trc_debug_level string| trc_article_id object| TRCImpl undefined| google_measure_js_timing object| Criteo object| apscustom boolean| htlbidStarted object| LoaderConfig function| quantserve function| __qc object| ezt object| _qoptions object| confiant object| launchPad object| launchPadConfiguration object| node function| __launchpad function| gtag object| GooglebQhCsO function| InteractionTypeImpl number| taboola_view_id boolean| creativeVendorLibraryLoaded boolean| _tb_dis string| pm_ppy string| _pmep string| _pmep_geo string| _pmpmk boolean| _pmasync boolean| _pmoptimization boolean| _pmoptimizationmanipulation boolean| _pmhp boolean| _pmsb object| pmk object| pmglb object| pmfa object| pmad object| pmdebug_c object| _pmenv object| _pma undefined| _tb_d undefined| _tb_rand object| _pm_ecd function| _pmloadfile function| pmws_request_done function| _tb_getUrlParameter object| __uid2SecureSignalProvider object| __uid2 object| criteo_pubtag object| criteo_identitytag_137 object| Criteo_identitytag_137 string| fpVersion string| fpBuild object| DeviceDetector object| Fingerprint object| g2ExtendInits object| G2Analytics object| G2Insights object| MG2Insights function| onYouTubeIframeAPIReady object| gaGlobal object| gaplugins object| gaData function| bt_eval function| bt_parameter function| bt_meta function| bt_cookie function| bt_data function| bt_log function| bt_handle_exception undefined| _bt_url_prefix undefined| _bt_referrer undefined| _bt_site undefined| _bt_mode function| btServe function| bt_data_escaped object| BrightTag object| nxtBundle object| webpackJsonpnxtBundle object| NxtInner object| Connext object| CnnXt object| _bcp object| Mustache function| BlueConicMetaDataService function| RuleService object| justDetectAdblock object| bc function| jwt_decode function| BlueConicEngagement object| bcConnectionUtil function| BlueConicDataLayerUtility function| md5 function| fbq function| _fbq object| _mather object| _mg2q object| _matherq object| tid object| LI object| __li__evt_bus object| liQ object| liQ_instances object| MG2DL object| COMSCORE object| ns_p function| TBVideoElem function| TBVideoEvents function| TBOptimizationAutoPlayInfoFromXPathAndURL object| _pmk function| TBWidgetVideoPlayer function| TBGenericVideoModule function| TBOtherPlayer function| TBVideoMetaData function| TBVideo function| TBVideoDetectionYoutubeAPI function| TBOptimizationTouchAndClickEventTracker function| TBWidgetStorage object| PMFileLoader object| PMPage object| PMTemplate function| PMTracking function| PMUniversalGA function| PMMdotLabs function| PMComScore function| PMPublisher function| TBOptimization function| PMGlobal function| pmws_getlocation_done object| pmdebug object| pmws object| ji object| _pm_mcg string| nam object| placementData undefined| nQuery number| ntvLoadStart object| ntv object| prdom object| onFocusEvents function| ntvjQueryInit function| ntvExtends function| ntvAppendStylesheet function| ntvAppendScript function| ntvGetElementViewability function| ntvArticleTracker function| ntvViewableImpressionTracker object| PostRelease object| ntvToutAds boolean| onFocus object| bc_json210 object| bc_json211 function| processGoogleToken object| googleToken object| googleIMState number| google_unique_id function| _____WB$wombat$assign$function_____ function| __WB_pmw object| gPartners object| criteo_syncframe_state object| cmTag function| UET function| UET_init function| UET_push function| confiantDfpWrap object| _cm_wfCounters object| bc_json212 function| _typeof2 function| __liSync object| confiantRefreshSlots object| confiantRefreshSlotsDebug undefined| ct undefined| et undefined| hourElapsed undefined| pixelDomain undefined| pxSrc undefined| px object| Moat#G23 object| MoatSuperV23 boolean| _lastFocusState string| a object| Moat#PML#23#1.2 boolean| Moat#EVA undefined| MoatOCR function| moatOcrSample object| MoatContent boolean| msgData object| criteo_pubtag_prebid_135 object| Criteo_prebid_135 function| _createForOfIteratorHelper function| _unsupportedIterableToArray function| _arrayLikeToArray object| adpnExecutions object| aliveChecks boolean| adpnLoaded number| lnt_z object| uetq object| tbopt object| ueto_589fd0e683 object| GoogleGcLKhOms function| CallTrkSwap function| CallTrk object| google_image_requests

330 Cookies

Domain/Path Name / Value
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ Name: bloom_page_location_address
Value:
www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/ Name: bloom_page_location_latlon
Value: ,
.taboola.com/medianewsgroup-mercurynews/ Name: taboola_session_id
Value: v2_cfa7831abef4b97bcc73077b9207f316_1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726_1687290278_1687290278_CNawjgYQtdRXGNjj2dKNMSABKAEwJjiJ6AdA6vUHSKfL2QNQ____________AVgAYABosrWxmb6uzo3eAXAB
a869.mercurynews.com/DG/DEFAULT Name: BCSessionID
Value: e9ed386f-ceb6-490e-9c28-0fae1ca9a01c
digitalfirstmedia.blueconic.net/DG/DEFAULT Name: BCSessionID
Value: e9ed386f-ceb6-490e-9c28-0fae1ca9a01c
.3lift.com/sync Name: sync
Value: CgkIOhD3h9rSjTE=
i6.liadm.com/s Name: _li_ss
Value: CgA
i.liadm.com/s Name: _li_ss
Value: CkYKBQgKEKwVCgUIBhCsFQoFCAwQthUKBgiiARCsFQoJCP____8HELYVCgUICxCsFQoGCIsBEKwVCgYI0gEQrBUKBQh-EKwV
.mercurynews.com/ Name: bc_tstgrp
Value: 4
.mercurynews.com/ Name: _pnvl
Value: false
.mercurynews.com/ Name: pushly.user_puuid
Value: x2vf8TYEP59P74JvA4VhEPZWdnVBXaxy
.mercurynews.com/ Name: _parsely_session
Value: {%22sid%22:1%2C%22surl%22:%22https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/%22%2C%22sref%22:%22%22%2C%22sts%22:1687290277395%2C%22slts%22:0}
.mercurynews.com/ Name: _parsely_visitor
Value: {%22id%22:%22pid=2ba5b962c55af6057bf954d95d567cd1%22%2C%22session_count%22:1%2C%22last_session_ts%22:1687290277395}
www.mercurynews.com/ Name: ai_user
Value: lg31j|2023-06-20T19:44:37.504Z
.viafoura.co/ Name: VfSess
Value: rm4h0vqgvorgj57jv7l3mgo610
.viafoura.co/ Name: vfThirdpartyCookiesEnabled
Value: true
.scorecardresearch.com/ Name: UID
Value: 1EE4d09159f41f7187997181687290277
.sitescout.com/ Name: ssi
Value: 08eb3579-ee48-40a3-bcf3-73b963aa13e4#1687290277844
www.mercurynews.com/ Name: _vfa
Value: www%2Emercurynews%2Ecom.00000000-0000-4000-8000-c86bf0725f23.286a83b5-7487-4649-a7c3-a322672ecbc1.1687290278.1687290278.1687290278.2
www.mercurynews.com/ Name: _vfz
Value: www%2Emercurynews%2Ecom.00000000-0000-4000-8000-c86bf0725f23.1687290278.2.medium=direct|source=|sharer_uuid=|terms=
.viafoura.co/ Name: vfDeviceId
Value: 449cac61-354d-4ee8-ac08-c6f68ca9c36f
.mercurynews.com/ Name: _gcl_au
Value: 1.1.124969367.1687290278
.mercurynews.com/ Name: osano_consentmanager_uuid
Value: 843be551-e8d4-4861-8827-36f0395ede02
.tapad.com/ Name: TapAd_TS
Value: 1687290278307
.tapad.com/ Name: TapAd_DID
Value: 6e633baa-8f35-487f-a052-7b9fb224da66
.mercurynews.com/ Name: osano_consentmanager
Value: 9pMhl03zRmNXL3sWS2MeXpFt_OR_UFgCDcM7fsUL0YDxJpeUSurNzzUH8ZPLJiJaDSgvitgOuqqzyDBrKmVSc1sfqjlmCa75Fhlk7Gan6NfhCA-06mDNvZgV35unN7oSjrhVRhYwzh86SWqWPhJAKIzd6z8mopQh-lvUAZ6vVy5r28rhWdQ4iCruDMkgv5CIXy9eJVlW_vmquqaaMIqFKaN_jd14lfhLkp6NhdJuj8ZHNGasjnkYEaoQz88OAldiknO8fk_7HWBbszGqDn5FZoN1ahPPtzdbs7R-LqzhU--d5k0nyiJbQ-dyl4BwFbcxhpUgRUgUdKNCYZINdqOAc6y65iNDjwjCaFw6wMSzXzNY8NNZ8A-ZLf1uukGiTbKc-xyXPDwQ5zAAEoXHUIHa1iWoPsm4DrU6xSYXLoB7ewlNbnvoFu0ipuH1beGg6qR6vtL_eRzf_EtGaWAr5A5YlsmicFAd9a0gUgA-_O3TtyrLJ8ZuSppQ0OtF8HHRCrQlzGSG6BDbFQCez8MtGI2B9gAXG4YnN8yqlCZDrxfPjl6uT9Er1DtSMS6OXRwJiho5qnVhyZ6Dm-xZk-GX5q5-JSMi6brFLrn6nURiw2ckcQ7YU6P6UTT_OZlIlnQ8S3k-8PeW__YtweyGG4TFDRo8ryJ8kNEB4rbvorSOjHGm7a_HzerIqVTMRdZVOcC6ItMdiPgBHljHXExyFh8SVUdarqXRrXc76ijwPldEsalr6eUt5Yl6KmID1NUPpSRn6tAA9m7i0iOeFVmSsHIJNO4wQAhtot6iRhJa
.adnxs.com/ Name: uuid2
Value: 3321274862842215126
www.mercurynews.com/ Name: _vfb
Value: www%2Emercurynews%2Ecom.00000000-0000-4000-8000-c86bf0725f23.1.10.1687290278....
.teads.tv/ Name: tt_viewer
Value: 46efcbb7-da6e-47d3-9679-7bd8e569db0c
.demdex.net/ Name: demdex
Value: 13018227043234807181659297677746900985
.exelator.com/ Name: EE
Value: "fb66aef49b2629190face8c0844c2992"
www.mercurynews.com/ Name: BCSessionID
Value: e9ed386f-ceb6-490e-9c28-0fae1ca9a01c
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: cb91de56a95aeab945914e3799e50f92
.crwdcntrl.net/ Name: _cc_cc
Value: "ACZ4XmNQSE6yNExJNTVLtDRNTE1MsjQxtTQ0STU2t7RMNTVIszRiAIKUSYzLQDQUAABdmgqV"
.crwdcntrl.net/ Name: _cc_aud
Value: "ABR4XmNgYGBImcS4DEhBAQAUIgGe"
.dpm.demdex.net/ Name: dpm
Value: 13018227043234807181659297677746900985
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQSEtycwsMTXNxDLJyMzI0tDSIC0xOdUi2cDCxCTZyNLSaHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDQZEl%252BUWb6ImfHxUUpaQyLSopPBR%252FJ1QYArSkp%252BQ%253D%253D"
.mercurynews.com/ Name: _ga
Value: GA1.2.461448689.1687290279
.mercurynews.com/ Name: _gid
Value: GA1.2.183842644.1687290279
digitalfirstmedia.blueconic.net/ Name: AWSALBCORS
Value: NU/S0DUWgo9h4Uvmz/x62UWqcukZnXYsFLy2KdLSj2J+TemXyYXKE5r9XbMbBWcctsHil1s7Lvleyh8m7GQ/esPp/i0smBKqqV+aftt8EcpzdWwB7cMpGaFA5xhL
.quantserve.com/ Name: mc
Value: 649201a6-a0676-52101-a5974
.mercurynews.com/ Name: _ml_ses
Value: *
.mercurynews.com/ Name: _matheriSegs
Value: MATHER_U9_INSTANTA_20200203
.mercurynews.com/ Name: _matherSegments
Value: MATHER_U9_INSTANTA_20200203
.taboola.com/ Name: t_gid
Value: 1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
.mercurynews.com/ Name: _li_dcdm_c
Value: .mercurynews.com
.mercurynews.com/ Name: _lc2_fpi
Value: f107d3ac6b63--01h3d5cx4vxevjc4be2gc9kkhz
.mercurynews.com/ Name: nxt_last_visit
Value: 1687290279120
.amazon-adsystem.com/ Name: ad-id
Value: AyKFLc9HmE44vbLFCoTUpOc
.amazon-adsystem.com/ Name: ad-privacy
Value: 0
www.mercurynews.com/ Name: trc_cookie_storage
Value: taboola%2520global%253Auser-id%3D1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
.mercurynews.com/ Name: __qca
Value: P0-396458604-1687290278155
.mercurynews.com/ Name: _ga_LMTT1ZNHB1
Value: GS1.1.1687290278.1.0.1687290279.0.0.0
.track.elissa.myastrology.com/ Name: a01201eb-6d43-4f28-a885-d54446312609-osz-v4
Value: Fi6EzqRr51YbGACf3Z3lz_AjTXojSQ94YGMlqYIltoA6e53GBbXVNBHxN1FrWQidZdlzl0FIVCSRAbGwtzK8GP9SLXW8_RHeieaRuZMZ8YDCTiIQ9qug7SlnZMEqHUEhqCHqVC-UeqQQDELfKX-xEftPkglHk5824BdAES70o6tKKTwdyd9PcDU0KMFf6o-bwlfQUVOV068r03_nDGmjErp6oL6QuSA_XdlL-nlv7JpAKVfk_8tiXu-CWE0gNGMxwIeZuQ4y32ZWGS5Pxwg0-bRIM-U-d_2enrRhxeM8SKESu0lWpgCg66NIRJvtNLWmsf0jln3dv7Rj4_f4wv63gQmhrDQ6TtRJQa7HO30DAd3z9dCSzYOZF8ciPhOF2N5tdXpX-7CajUS8TsW0RZD7nW2MY2xldk3xfhsy4a2_ySoZL355E_jxFu5qJPPMCLWls5kRD8w8wXXzrmtuuLBHAtCHQgb5J-2i25peeT1_x4HSX-dVQM5W5yKGgFcycEJJUdUfbjIWA50dUkZQ6oro6boW1IZ336DiaTlDZXCetE3buVEv5d50GIDC7DwcDlgaO9ZOSBoSZDmi3u9GwtClhnZqSF_PHshgl6Y7UbbKsF4_Vn5-TjCPgB03fFzGjjvNDOPuIr2CJC_KDFnrCxPI2Ucr780WlgzS4-FFGw41BJHgRAvxrEDyoxu2e2CiN55CCVEzmEN4BGBIXWeggDHPV7WNf6iHsB6B0L4t8iR5HlGDdPOaNnyD2QDORMtocqmyovTbNzCGNbkcb5fJ4rfx5XoJSbL5ziuohzoEkUmQprrE08QfqKCQ2hHlcAdPy--puGsqWQk0CVPdy9IySWfEAzjB7HYl2sr0q6lXb6kZH6mdSNm37WAUvFZuIiw_eBQLQqXRh5cw7MwMP4ViBHtzlyBNvBv7ZdXXOPj50UGIOEQgYURhSFGDUg1HgD2s1uRM9bgGbRSbI3i_EDnviTy27cJlor72drqYJ09qPDspUnz4oXAwrvTcR7Jy0rkcIKy7MdxdlLTASZsUXL45qL5c1hMp74GhIKvHJOybLCR2i4wMN9-JDHPaVbSDaKfz5iEgUd3sSpt1JNbLcmWWt5GX5x7qixVn5cw7I72VcFYjMX6laY47cm9FJUoBh2DnldIEGmG0VgBi-7DXbvX1gclmjaFMS0Q5TbWLKbv-yIKn3ZQ
www.mercurynews.com/ Name: ntv_as_us_privacy
Value: 1---
.liadm.com/ Name: lidid
Value: 7130a7b6-bb6a-4db6-8b12-3801a087cf17
.postrelease.com/ Name: visitor
Value: 255c3f33-04a7-4e40-a8c7-66ac14eab13d
.postrelease.com/ Name: status
Value: 0
a869.mercurynews.com/ Name: AWSALB
Value: /58TbDVGTy6PJGCtTuutQl+W8lckBVAewSGxaP6f3i9PtmPDo1S8kloCu3qfuuKH4YQrcx0wRSwmSnU4W6G1IzOEtK8cygLjRrEtBgLVVW/HU0kg/P5OaGmUGI/j
a869.mercurynews.com/ Name: AWSALBCORS
Value: /58TbDVGTy6PJGCtTuutQl+W8lckBVAewSGxaP6f3i9PtmPDo1S8kloCu3qfuuKH4YQrcx0wRSwmSnU4W6G1IzOEtK8cygLjRrEtBgLVVW/HU0kg/P5OaGmUGI/j
.criteo.com/ Name: uid
Value: fbc3b4d9-a11b-4371-a88d-35e24043ca77
.media.net/ Name: visitor-id
Value: 3302918801455535000V10
.smaato.net/ Name: SCM
Value: 4bdf9286
.smaato.net/ Name: SCMaps
Value: 4bdf9286
.casalemedia.com/ Name: CMID
Value: ZJIBqD7bZiR98t4YH35qSwAA
.casalemedia.com/ Name: CMPS
Value: 3485
.casalemedia.com/ Name: CMPRO
Value: 3485
.gumgum.com/ Name: vst
Value: u_505daddb-b9f3-4eff-a7a6-25c842c0512d
.sharethrough.com/ Name: stx_user_id
Value: 45bb695b-34f1-45bc-b104-fd1bfa86c044
.smartadserver.com/ Name: pid
Value: 4777538607685951564
www.mercurynews.com/ Name: btpdb.t4tmU86.dGZjLjc1MDQ0Nzc
Value: U0VTU0lPTg
www.mercurynews.com/ Name: ntvSession
Value: {"id":8685663,"placementID":1028524,"lastInteraction":1687290280507,"sessionStart":1687290280507,"sessionEndDate":1687305600000,"experiment":""}
www.mercurynews.com/ Name: _ntv_uid
Value: 255c3f33-04a7-4e40-a8c7-66ac14eab13d
.postrelease.com/ Name: ver
Value: 1
.doubleclick.net/ Name: IDE
Value: AHWqTUnKWyG45n_J0ujRCnxWHqMKjyFYfrZ1ja34RkbPx8IgEJsddu0ktDgYuAjv
.mercurynews.com/ Name: __gads
Value: ID=2a155da8dea23fa8:T=1687290279:RT=1687290279:S=ALNI_MZag-KaHfPvInqD3jUyqai_PEpSaw
.contextweb.com/ Name: V
Value: 37Wunos71Ooo
bh.contextweb.com/ Name: INGRESSCOOKIE
Value: 814a0656b821a536
.mercurynews.com/ Name: __gpi
Value: UID=00000c52bd207673:T=1687290279:RT=1687290279:S=ALNI_Ma5lMtSzeU4G6-9L7c_E3E1qQ58Kg
.3lift.com/ Name: tluid
Value: 4361119996463975483505
.yellowblue.io/ Name: wrvUserID
Value: _NzvLO6tCp_s
.yieldmo.com/ Name: yieldmo_id
Value: g64ff5b6b6307102e7fd%7C1687290280594%7C0%7C
.kargo.com/ Name: ktcid
Value: 1c97a7b8-ab0e-01de-56ee-b42e29e6c72b
.lijit.com/ Name: ljt_reader
Value: G2VgbPZHuyVpOjRtQ-i3ojE3
.lijit.com/ Name: ljtrtbexp
Value: eJyrVjKxVLIyNLOwMLG0tLAw0FGyMEbjm6PyTdDkLU2Q%2BbUArHoQyw%3D%3D
.mercurynews.com/ Name: _gat_UA-61435456-5
Value: 1
.adsrvr.org/ Name: TDID
Value: db51a350-c421-4780-94b8-db6155d007ec
.bidswitch.net/ Name: tuuid
Value: 2491035f-3b91-450a-bf47-d3da43a3fb7b
.bidswitch.net/ Name: c
Value: 1687290280
.openx.net/ Name: i
Value: f7a85353-70f1-4637-a5a2-d03c6695c62c|1687290280
.yahoo.com/ Name: A3
Value: d=AQABBKgBkmQCEC_kY6pbcreDcDsIiY1B-2oFEgEBAQFTk2SbZAAAAAAA_eMAAA&S=AQAAAijoeyTWuICpeeGmL1QS5Tk
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZJIBqAABSFKRcAAz
.zemanta.com/ Name: zuid
Value: oRzH9Zt83axgglTEQFsr
.deepintent.com/ Name: CDIUSER
Value: di_a029244c9d2a48d68c380
.technoratimedia.com/ Name: tads_uidp_77
Value: Qzx8Fth1lRqwLigKGeiGAZsRaeTFhsG7HikZr4WvlCU
.technoratimedia.com/ Name: tads_uidp_88
Value: 1743599479903761032916
.technoratimedia.com/ Name: tads_uidp_44
Value: LJ2KLSYU-M-2YIM
.technoratimedia.com/ Name: tads_uidp_45
Value: BAD6476E-515C-40EF-942D-693B9AD99B7D
.technoratimedia.com/ Name: tads_uidp_46
Value: 7735810810083502427
.technoratimedia.com/ Name: tads_uidp_79
Value: 00571ff3-3f39-43da-9514-e390b7dc3acc
.technoratimedia.com/ Name: tads_uidp_37
Value: 7450de43-18ca-3cf5-be9e-f2863244ba84
.technoratimedia.com/ Name: tads_uidp_48
Value: 0667b527-98e1-4eaa-bed1-6d356da24ed9
.technoratimedia.com/ Name: tads_uidp_49
Value: AAAMmBzlYZ6qGgM_BcZbAAAAAAA
.technoratimedia.com/ Name: tads_uidp_7
Value: f17bf2de-ebee-45fd-b362-9b3e5115b62a
.technoratimedia.com/ Name: tads_uidp_80
Value: y-V9t4_MNE2uFGJdkBsphjNo7WGJSthR7Y~A
.technoratimedia.com/ Name: tads_uidp_70
Value: 1673948501052-981480834937-007220-006-006384
.technoratimedia.com/ Name: tads_uidp_82
Value: ZJBk1j-vaUyBByDDHLsv5QAA&3272
.technoratimedia.com/ Name: tads_uidp_50
Value: d6b19e7b-da98-4dd9-b521-db2f52543ab5
.technoratimedia.com/ Name: tads_uidp_61
Value: 212189934457817
.technoratimedia.com/ Name: tads_uidp_62
Value: 3302296631454946000V10
.technoratimedia.com/ Name: tads_uidp_64
Value: 2jkah48xKodCAB_zRgLSwfaMrA1pqygk
.technoratimedia.com/ Name: tads_uidp_76
Value: RX-83c05a1d-63bd-431d-a706-1894904d8530-005
.technoratimedia.com/ Name: tads_uid
Value: 16F85AA78ED646369CC5112051089037
.technoratimedia.com/ Name: tads_uid_cd
Value: 20221014204242+0000
.technoratimedia.com/ Name: tads_zora
Value: 2
.adgrx.com/ Name: ADGRX_UID
Value: e5c920de-0fa2-11ee-876c-8dbcb6804b27
sync.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-aee3e84a-9648-5082-7b18-bc1b6a6da401.e7h%2B%2BdmAV3hD3vVtN%2BTsLhU7i9544YURMkJXlybjRFY
sync.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AruPoSpZIUIJ7GLwbam2kAZU4mbs.OQRX4VcCym59xyafX4dXwu7w7l%2F4XbdkL9zRdjuVTJA
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3AruPoSpZIUIJ7GLwbam2kAZU4mbs.OQRX4VcCym59xyafX4dXwu7w7l%2F4XbdkL9zRdjuVTJA
.ipredictive.com/ Name: cu
Value: dc345a35-a603-4ec3-b75a-7bd7631cedf4|1687290280946
.outbrain.com/ Name: obuid
Value: 3f638516-bd65-4167-88e8-e4c310c71e6d
.mathtag.com/ Name: uuid
Value: 5f956492-01a9-4900-b96e-6cf0342c9990
.simpli.fi/ Name: suid
Value: 8B59A33699C741AFA2C7A091E574C7C9
.33across.com/ Name: 33x_ps
Value: u%3D212190061798909%3As1%3D1687290281076%3Ats%3D1687290281076
.bidswitch.net/ Name: tuuid_lu
Value: 1687290281
.go.sonobi.com/ Name: __uis
Value: 2c0f44d2-6a66-40d3-a3dc-600d11c96224
.360yield.com/ Name: tuuid
Value: 92e9d51d-f58b-4a55-97b2-6ee67deb9268
.360yield.com/ Name: tuuid_lu
Value: 1687290281
.media.net/ Name: data-ris
Value: {{APID}}~~25
.csync.loopme.me/ Name: viewer_token
Value: ff76b2fa-a2e6-48d5-8a14-13731d407294
.ads.yieldmo.com/ Name: ptrrc
Value: LJ4P2F0B-P-LXKJ
.lijit.com/ Name: _ljtrtb_43
Value: m9yu7p3Z9uqAiafqmt666Z_Zp-2AiaLlmtzxSaVw
www.mercurynews.com/ Name: ai_session
Value: FYNFf|1687290281381.9|1687290281381.9
.adgrx.com/ Name: ADGRX_CM_CASALE_BRIDGED
Value: 1
.blismedia.com/ Name: b
Value: 649201A93686F07E28538478BLIS
.bluekai.com/ Name: bku
Value: ikG99vAOAZxuSIRh
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 479CC621-B2E0-490D-8915-42055EBBC0EB
.creativecdn.com/ Name: u
Value: RrG2QWcZ9j7dv54OJsuG
.creativecdn.com/ Name: ts
Value: 1687290281
.mfadsrvr.com/ Name: tuuid
Value: 45f36b13-857c-4e12-af33-6a514e9bfc45
.mfadsrvr.com/ Name: c
Value: 1687290281
.mfadsrvr.com/ Name: tuuid_lu
Value: 1687290281
.ads.yieldmo.com/ Name: ptran
Value: 3321274862842215126
.lijit.com/ Name: _ljtrtb_42
Value: 1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726
.lijit.com/ Name: _ljtrtb_49
Value: 37Wunos71Ooo
beacon.lynx.cognitivlabs.com/ Name: UID
Value: cde16cd9-d9ed-4cdd-9d7f-cd6930766499
.socdm.com/ Name: SOC
Value: ZJIBqcCo5ukAAJLgBLwAAAAA
.adscale.de/ Name: uu
Value: 6fadbf2f9c8147e5bed870a0b19b7fb3
.mfadsrvr.com/ Name: ssh
Value: !sovrn,1687290281!taboola,1687290281
.lijit.com/ Name: _ljtrtb_83
Value: LJ4P2F0B-P-LXKJ
.admixer.net/ Name: am-uid
Value: 3e3e5b7a69bb4c839bc23ca0143ab614
.rezync.com/ Name: zync-uuid
Value: 5a991fdb-988c-4f1f-9a42-ecad99d56781:1687290282.0281818
.turn.com/ Name: uid
Value: 2889108176641716303
.lijit.com/ Name: ljtrtb
Value: eJwVzMsKwjAQheF3ydqBZpJOEne6cFELFgSVbqSxCQjWtJjgDd%2FddHk%2BOP%2BXScOWTKhjuoeH4rsQ2IJpka2uZIObYg0N1KdtlVliZm698AVqcAURSLQEGmUHpuelIdLOqRJiukSrrVZI82%2FODead1Chak6bVtfPTEImoPbcjYN71bYif1747PNnvDxrVKSU%3D
.lijit.com/ Name: _ljtrtb_87
Value: 45f36b13-857c-4e12-af33-6a514e9bfc45
.adscale.de/ Name: cct
Value: 1687290282086
.addthis.com/ Name: na_id
Value: 2023062019444200017869587613
.addthis.com/ Name: na_tc
Value: Y
.addthis.com/ Name: uid
Value: 649201aa86806e7d
.addthis.com/ Name: ouid
Value: 649201aa0001cd44dc2cdb7bae469065f1cea89e5a2b8c8cfb5a
.adx.opera.com/ Name: UID
Value: OPU51355131955541c0b2ce4c671e5ba5e7
.ads.yieldmo.com/ Name: ptrpub
Value: 479CC621-B2E0-490D-8915-42055EBBC0EB
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 6810-db51a350-c421-4780-94b8-db6155d007ec&KRTB&22918-db51a350-c421-4780-94b8-db6155d007ec&KRTB&22926-db51a350-c421-4780-94b8-db6155d007ec&KRTB&23031-db51a350-c421-4780-94b8-db6155d007ec
.pubmatic.com/ Name: KRTBCOOKIE_18
Value: 22947-969188716634525412
.pubmatic.com/ Name: KRTBCOOKIE_22
Value: 14911-2889108176641716303&KRTB&23150-2889108176641716303
.pubmatic.com/ Name: KRTBCOOKIE_80
Value: 22987-CAESEBwVNXZ9auhyOaTXcxEN6nE&KRTB&16514-CAESEBwVNXZ9auhyOaTXcxEN6nE&KRTB&23025-CAESEBwVNXZ9auhyOaTXcxEN6nE&KRTB&23386-CAESEBwVNXZ9auhyOaTXcxEN6nE
.dlx.addthis.com/ Name: na_sc_x
Value: 1
.pubmatic.com/ Name: KRTBCOOKIE_148
Value: 19421-uid:8B59A33699C741AFA2C7A091E574C7C9&KRTB&23489-uid:8B59A33699C741AFA2C7A091E574C7C9
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005%22%7D
.rfihub.com/ Name: eud
Value: H4sIAAAAAAAA_5skbG6aaGlpmJaSpGtpYZGsa5JmmKZrmWhipJuanJhiaZliamZuYWhlaGZhbmRpYGRhpAckDIFwljAvQtDYwnIRGh8AQ8CE1FoAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAA_-MSsjSzMDMyNbewMDEyMrU0NDI0E-Iz1HXNiPTxcUwsDfMzqQAALxJNtiQAAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAA_-MSsjSzMDMyNbewMDEyMrU0NDI0E-Iz1HXNiPTxcUwsDfMzqQAALxJNtiQAAAA
.rfihub.com/ Name: euds
Value: H4sIAAAAAAAA_w3E0Q3AIAgFwJ-uQ1OIynvdhkoZxMk1l9y6vAeplZ8QmNJKSxjN5J-RZPbh0FcH3PgY7D7psQE2YErcOgAAAA
.thrtle.com/ Name: mc
Value: eyJpZCI6IjY5MjQ1ODMyLTY2NjEtNDQ5ZS04MmNkLWYyZmI4NTliNzNlMCIsImwiOjE2ODcyOTAyODI0MTgsInQiOjF9
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value: 1!4123-2!4123
.ads.yieldmo.com/ Name: ptrunl
Value: RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
.adform.net/ Name: C
Value: 1
.linkedin.com/ Name: bcookie
Value: "v=2&820b877b-6019-4ce7-8f51-83d4e486ae30"
.linkedin.com/ Name: lidc
Value: "b=TGST01:s=T:r=T:a=T:p=T:g=3085:u=1:x=1:i=1687290282:t=1687376682:v=2:sig=AQEpPeClEtUUBWwpQQfqPZgV06J_oF0t"
live.rezync.com/ Name: sd-session-id
Value: .eJwNilsKwyAQAO-y37F0Fx-7XiZYXUHa2BLTn4bcvTIwMDAnrB_dt9S1HxCP_asL5FebNSCeMNpv0ydEEM-eXGC2RE6Q0MO1wNAx2ruvrczFJRGs5WGEORtbsRpJlozmVESK84ExoudAciem2xRO4PoDpOIlxw.ZJIBqg.1m5YhkU0KFr1AJrEHJta5NTLABA
.adform.net/ Name: uid
Value: 1235390588561432912
.ads.yieldmo.com/ Name: consentc
Value: 1
.ads.yieldmo.com/ Name: rptr
Value: rc%3D1688499360000%7Cunl%3D1688499360000%7Cc%3D1172569%7Ctapad%3D1688499360000%7Cpub%3D1688499360000%7Can%3D1688499360000
.ads.yieldmo.com/ Name: ptrc
Value: CAESECsNeKOUbQi_4bsJ6b7Oud8
.smartadserver.com/ Name: vs
Value: 563381=5504864
.smartadserver.com/ Name: sasd2
Value: q=%24qc%3D1308948106%3B%24ql%3DHigh%3B%24qpc%3D28700%3B%24qt%3D124_1509_77271t%3B%24dma%3D0&c=1&l=1501522464&lo=384595258&lt=638228870834295736&o=1
.smartadserver.com/ Name: sasd
Value: %24qc%3D1308948106%3B%24ql%3DHigh%3B%24qpc%3D28700%3B%24qt%3D124_1509_77271t%3B%24dma%3D0
.mercurynews.com/ Name: _pnlspid
Value: 10402
.mercurynews.com/ Name: _pnss
Value: dismissed
.mercurynews.com/ Name: _pnpdm
Value: true
.mercurynews.com/ Name: anonDeviceId
Value: 23c7b2911e37a18862bb7d8d9656a1d8
.adnxs.com/ Name: icu
Value: ChgIiNJ7EAoYAyADKAMwq4PIpAY4A0ADSAMKGQipr4gBEAoYASABKAEwqYPIpAY4AUABSAEKGQiYrooBEAoYASABKAEwpoPIpAY4AUABSAEQq4PIpAYYBA..
.semasio.net/ Name: SEUNCY
Value: 885894C13F35428C
.mercurynews.com/ Name: _fbp
Value: fb.1.1687290284402.1346453395
.mercurynews.com/ Name: _uetsid
Value: e7e095b00fa211ee84e63d750ae8cfdb
.mercurynews.com/ Name: _uetvid
Value: e7e0f6800fa211ee8bc295fcd7296e79
.bing.com/ Name: MUID
Value: 0E0C23F0D4B0626513F130C6D58B637D
.bat.bing.com/ Name: MR
Value: 0
.mercurynews.com/ Name: calltrk_referrer
Value: direct
.mercurynews.com/ Name: calltrk_landing
Value: https%3A//www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
.krxd.net/ Name: _kuid_
Value: PoI5U9Zt
.analytics.yahoo.com/ Name: IDSYNC
Value: "19c8~2cbv:18z8~2cbv:1769~2cbv"
.deepintent.com/ Name: CDIPARTNERS
Value: %7B%22141%22%3A%2220230620%22%7D
.pubmatic.com/ Name: KRTBCOOKIE_57
Value: 22776-3321274862842215126&KRTB&23339-3321274862842215126
.pubmatic.com/ Name: KRTBCOOKIE_1251
Value: 23269-di_a029244c9d2a48d68c380
.pubmatic.com/ Name: KRTBCOOKIE_27
Value: 16735-uid:5f956492-01a9-4900-b96e-6cf0342c9990&KRTB&16736-uid:5f956492-01a9-4900-b96e-6cf0342c9990&KRTB&23019-uid:5f956492-01a9-4900-b96e-6cf0342c9990&KRTB&23114-uid:5f956492-01a9-4900-b96e-6cf0342c9990
.pubmatic.com/ Name: KRTBCOOKIE_153
Value: 1923-TsbVTkjDjUpVk9xKT8TBSUrD3E1Vk9lFT8Zhr1Cj&KRTB&19420-TsbVTkjDjUpVk9xKT8TBSUrD3E1Vk9lFT8Zhr1Cj&KRTB&22979-TsbVTkjDjUpVk9xKT8TBSUrD3E1Vk9lFT8Zhr1Cj&KRTB&23462-TsbVTkjDjUpVk9xKT8TBSUrD3E1Vk9lFT8Zhr1Cj
.bfmio.com/ Name: __187_cid
Value: 479CC621-B2E0-490D-8915-42055EBBC0EB
.bfmio.com/ Name: __io_cid
Value: 03da7d0ca532645c07bf6e1e3e116ed71a4ed623
.bidr.io/ Name: bito
Value: AAEDUk7JJAMAACROtOIu9g
.bidr.io/ Name: bitoIsSecure
Value: ok
.pubmatic.com/ Name: KRTBCOOKIE_279
Value: 22890-dc345a35-a603-4ec3-b75a-7bd7631cedf4&KRTB&23011-dc345a35-a603-4ec3-b75a-7bd7631cedf4&KRTB&23355-dc345a35-a603-4ec3-b75a-7bd7631cedf4
.pubmatic.com/ Name: KRTBCOOKIE_32
Value: 11175-AAAHPMPxJ_kugQMC7ljAAAAAAAA&KRTB&22713-AAAHPMPxJ_kugQMC7ljAAAAAAAA&KRTB&22715-AAAHPMPxJ_kugQMC7ljAAAAAAAA
.adkernel.com/ Name: ADKUID
Value: A4735317727298828258
.contextweb.com/ Name: pb_rtb_ev
Value: 3-1l9q|4is.0.CAESEDCqW60D2mGdp7ne38rlgqo|7TY.0|7dW.0.1|2N.0.AAAMwa38I1MJswMnwj_kAAAAAAA|3oy.0|7bq.0.1|5Ql.0.1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726|7dN.0.AAEDUk7JJAMAACROtOIu9g
.pubmatic.com/ Name: KRTBCOOKIE_699
Value: 22727-AAEDUk7JJAMAACROtOIu9g
.pubmatic.com/ Name: KRTBCOOKIE_188
Value: 3189-08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341&KRTB&23418-08eb3579-ee48-40a3-bcf3-73b963aa13e4-649201a5-4341
.marketiq.com/ Name: ADK_EX_685
Value: 1
.marketiq.com/ Name: ADKUID
Value: A4735317727298828258
.rubiconproject.com/ Name: khaos
Value: LJ4P2KW9-15-LLQ7
.mxptint.net/ Name: mxpim
Value: R33646_104945626_B755AE54.1.0000000000000000649201AE
.pubmatic.com/ Name: KRTBCOOKIE_52
Value: 22772-R33646_104945626_B755AE54&KRTB&23092-R33646_104945626_B755AE54
.pubmatic.com/ Name: KRTBCOOKIE_466
Value: 16530-2491035f-3b91-450a-bf47-d3da43a3fb7b
.sojern.com/ Name: gid
Value: CAESEMvO9nfQq9fa3SYmHw8Vt2o
.sojern.com/ Name: cid
Value: d7c2345f-9ece-2862-0028-b075c773590c#1687219200000
.www.mercurynews.com/ Name: sub_nxt_upd_ac_DFM_BANGWPPRODWAB_PROD
Value: 1
.quantserve.com/ Name: d
Value: ELUBGAGjKfijDejbEKj6EA
.omnitagjs.com/ Name: ayl_visitor
Value: aba53805585c3b3f5f03fcf3ef82f98f
.www.mercurynews.com/ Name: sub_nxt_DFM_BANGWPPRODWAB_PROD
Value: {%222%22:{%22104000%22:{%22ac%22:1%2C%22ac_d%22:1%2C%22s%22:1687290287223}%2C%22104103%22:{%22ac%22:0%2C%22ac_d%22:0%2C%22s%22:1687290287115}%2C%22_ac_d%22:1%2C%22_ac%22:1%2C%22_acnv%22:%22104000%22}}
.pubmatic.com/ Name: SyncRTB3
Value: 1687824000%3A38_15_223_2%7C1688083200%3A63%7C1692403200%3A69%7C1689811200%3A224%7C1688428800%3A176_96_239_178_21_55_240_238_204_48_165_5_249_7_56_214_8_54_233_234_22_166_243_3_99_71_220_250_46_13_104_231_81%7C1688515200%3A35
.mercurynews.com/ Name: cto_bundle
Value: qi4M2l90amV0bXg2enFNMG9EVXhtTGp1MmhBTU83emhLa0ZOZGZNYlRZZkdQUlBreVQ1cE8yRWNVQ2JDNEJUJTJCZyUyQm1nNnFMYVVralUxVSUyRlF5NlB0V2YlMkJ1M3o3JTJCb1V3aXo4NDJ2YmJuOTI3Q1NLajUlMkI0ZzEzd0olMkJUVmNYRUgxSFNSREdNaEUlMkJ4VG16Skx5ellpZ3pkR1h6U3NnJTNEJTNE
.adgrx.com/ Name: ADGRX_CM_PUBMATIC_BRIDGED
Value: 1
.pubmatic.com/ Name: KRTBCOOKIE_1003
Value: 22761-e5c920de-0fa2-11ee-876c-8dbcb6804b27&KRTB&23275-e5c920de-0fa2-11ee-876c-8dbcb6804b27
.pubmatic.com/ Name: KRTBCOOKIE_1278
Value: 23329-cde16cd9-d9ed-4cdd-9d7f-cd6930766499&KRTB&23340-cde16cd9-d9ed-4cdd-9d7f-cd6930766499&KRTB&23498-cde16cd9-d9ed-4cdd-9d7f-cd6930766499
.rlcdn.com/ Name: pxrc
Value: CKuDyKQGEgUI6AcQABIFCOhHEAUSBgi66gEQAA==
beacon.lynx.cognitivlabs.com/ Name: ss
Value: K9CNzIdRZleHrAcffObUd6BefFdap7Lyu8GwydrpKRXgwMu6s%2BUw0JY13XYVIp3cjaBr8wtmofp38Vw0toO0bfAiGLwpoaFyDe1b63f4RuE%3D
ads.playground.xyz/ Name: connect.sid
Value: s%3ACdFRS-6hA9KlT2LINVbGeKK409VHcg0V.cgKh5zZ%2BIiYTxH9YBKnCSD4N5BdQcjggusK%2BBtUPNfg
.ctnsnet.com/ Name: cid_592dd44978b347c18af3b880f4397283
Value: 1
.pubmatic.com/ Name: KRTBCOOKIE_860
Value: 16335-ruPoSpZIUIJ7GLwbam2kAZU4mbs&KRTB&23334-ruPoSpZIUIJ7GLwbam2kAZU4mbs&KRTB&23417-ruPoSpZIUIJ7GLwbam2kAZU4mbs&KRTB&23426-ruPoSpZIUIJ7GLwbam2kAZU4mbs
.acuityplatform.com/ Name: auid
Value: 792501305684
.acuityplatform.com/ Name: aum
Value: "OikKAfqbdXNlck1hdGNoQnlVc2VyTWF0Y2hpbmdJZE1hcPqANvqNdXNlck1hdGNoaW5nSWTMkWxhc3REcm9wVGltZU1pbGxpcyUBRDZKaU6kmGxhc3RTdWNjZXNzZnVsTWF0Y2hNaWxsaXMlAUQ2SmlOpI90aGlyZFBhcnR5VXNlcklkIfv7hnZlcnNpb27C+w=="
.w55c.net/ Name: wfivefivec
Value: 09wHc8i51QbHhu5
.pubmatic.com/ Name: KRTBCOOKIE_469
Value: 8273-792501305684&KRTB&23428-792501305684
.pubmatic.com/ Name: PugT
Value: 1687290288
.pubmatic.com/ Name: KRTBCOOKIE_1305
Value: 23408-479CC621-B2E0-490D-8915-42055EBBC0EB&KRTB&23413-479CC621-B2E0-490D-8915-42055EBBC0EB&KRTB&23479-479CC621-B2E0-490D-8915-42055EBBC0EB
.w55c.net/ Name: matchpubmatic
Value: 5
.pubmatic.com/ Name: KRTBCOOKIE_594
Value: 17105-RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005&KRTB&17107-RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005
.inmobi.com/ Name: idsp_c
Value: d93de280-8ab8-456d-b53b-9ab646fa4468
.pubmatic.com/ Name: KRTBCOOKIE_107
Value: 1471-uid:09wHc8i51QbHhu5&KRTB&23421-uid:09wHc8i51QbHhu5
.owneriq.net/ Name: p2
Value: pmc
.owneriq.net/ Name: si
Value: Q7405766881343085934P
.owneriq.net/ Name: pmc
Value: 1
.tribalfusion.com/ Name: ANON_ID
Value: arnseFNZaiMjAmemFmDgpd5IcfYEeQkI0pbkqo7DR1gT7Uv3STK5UtLCTvsgtZcthX1LCiej1ZbZa7XiUTAf1kqZa
.pubmatic.com/ Name: KRTBCOOKIE_391
Value: 22924-1235390588561432912&KRTB&23263-1235390588561432912&KRTB&23481-1235390588561432912
.quantserve.com/ Name: sp
Value: CgwIgq0DEgYIsIPIpAY=
.pippio.com/ Name: did
Value: LPOwb4ScYajUUdti
.pippio.com/ Name: didts
Value: 1687290288
.pippio.com/ Name: nnls
Value:
.mercurynews.com/ Name: _ml_id
Value: 1bfd33dc-1dec-4854-b026-244377afad71.1687290279.1.1687290289.1687290279
.us.ck-ie.com/ Name: CID
Value: 2ff1503e25c6ba4f3b8d35bfdf2feb671e8d1751
.pippio.com/ Name: pxrc
Value: CLGDyKQGEgQIAhAAEgYI7OsBEAA=
.betweendigital.com/ Name: dc
Value: was1
.betweendigital.com/ Name: tuuid
Value: e85e87b7-5c57-53ab-9b57-f4bcffc5f50d
.betweendigital.com/ Name: ss
Value: 1
.c.appier.net/ Name: _auid
Value: EBt_tnDEDsSGBBPtsQGSZA
.pubmatic.com/ Name: KRTBCOOKIE_904
Value: 16787-EBt_tnDEDsSGBBPtsQGSZA
.linksynergy.com/ Name: rmuid
Value: 365f9e71-e58f-498c-87fb-3ce6d43b34a3
.linksynergy.com/ Name: icts
Value: 2023-06-20T19:44:49Z
.rlcdn.com/ Name: rlas3
Value: MP0FOQ8qmvACVL4DE41cHY3Qen3kSuHkSoa9uZyTw0U=
.adsby.bidtheatre.com/ Name: __kuid
Value: 8e573587-b904-4733-a2c4-ff0a85ac28aa.456504289
.sportradarserving.com/ Name: zuuid
Value: 48af5e8d-0e41-4408-b340-0efe3a2b26fc
.sportradarserving.com/ Name: c
Value: 1687290290
.sportradarserving.com/ Name: zuuid_lu
Value: 1687290290
.sportradarserving.com/ Name: zuuid_k
Value: 1
.sportradarserving.com/ Name: zuuid_k_lu
Value: 1687290290
.pswec.com/ Name: tuuid
Value: 7ad943f4-c122-4afd-821a-f70b289c410c
.pswec.com/ Name: c
Value: 1687290290
.pswec.com/ Name: tuuid_lu
Value: 1687290290
.pubmatic.com/ Name: SPugT
Value: 1687290289
.mediarithmics.com/ Name: mics_vid
Value: 38886178730
.mediarithmics.com/ Name: mics_uaid
Value: web:1:218406a9-2ec7-4e1f-998b-48f4fac0878f
.mediarithmics.com/ Name: mics_lts
Value: 1687290290687
.richaudience.com/ Name: pdid
Value: 8e94c585-96a4-4941-b2e1-1zz1687290289
.pubmatic.com/ Name: chkChromeAb67Sec
Value: 12
.pubmatic.com/ Name: DPSync3
Value: 1688256000%3A257%7C1688428800%3A245_235_201_256_263_262_261_258_236_260_259_255%7C1687824000%3A252_248_253
.creative-serving.com/ Name: tuuid
Value: 1d360e72-ed0a-468d-af20-61ff2dc87248
.creative-serving.com/ Name: c
Value: 1687290290
.creative-serving.com/ Name: tuuid_lu
Value: 1687290290
.adfarm1.adition.com/ Name: UserID1
Value: 7246856614452983954
.smartadserver.com/ Name: TestIfCookieP
Value: ok
.smartadserver.com/ Name: pbw
Value: %24b%3d16999%3b%24o%3d11100
.smartadserver.com/ Name: csync
Value: 31:2491035f-3b91-450a-bf47-d3da43a3fb7b|32:2889108176641716303|49:7246856614452983954|76:CAESEN6Bv2XV7wpWXcvjVaO6wck|79:fbc3b4d9-a11b-4371-a88d-35e24043ca77|80:x7J1AcG3LQXc53wFxrBhBsO3fALc53kKxrK5PUrS|91:479CC621-B2E0-490D-8915-42055EBBC0EB|107:1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726|111:ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A|113:RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005|116:oRzH9Zt83axgglTEQFsr|117:aba53805585c3b3f5f03fcf3ef82f98f|124:ff76b2fa-a2e6-48d5-8a14-13731d407294|127:AAEDUk7JJAMAACROtOIu9g|134:OB_OK|139:0
.id5-sync.com/ Name: id5
Value: 3e242369-eddd-78f5-8873-3447a590120b#1687290281872#4
.richaudience.com/ Name: avcid-bsx-uid
Value: AAEDUk7JJAMAACROtOIu9g
.ads.pubmatic.com/ Name: pubsyncexp
Value: 1687311891039
.richaudience.com/ Name: avcid-bsw-uid
Value: 2491035f-3b91-450a-bf47-d3da43a3fb7b
.go.sonobi.com/ Name: HAPLB8S
Value: s85150|ZJIBt
.richaudience.com/ Name: avcid-sma-uid
Value: 4777538607685951564
io.narrative.io/ Name: io.narrative.guid.v2
Value: ebe4c0e1-0fa2-11ee-a591-0a3986670f6f
.audrte.com/ Name: arcki2
Value: g2bhsX6bd1tR4KmX3dqv-vtGg!20220908!1687290291185!ip#149.56.153.187
.audrte.com/ Name: arcki2_pubmatic
Value: 479CC621-B2E0-490D-8915-42055EBBC0EB!20220908!1687290291188
.audrte.com/ Name: arcki2_ddp2
Value: g2bhsX6bd1tR4KmX3dqv-vtGg!20220908!1687290291304
.betweendigital.com/ Name: ut
Value: ZJIBswAGZLgYdSLMBHq6J_x05t8Hm3CZqI7Fkw==
.sitescout.com/ Name: _ssuma
Value: eyIzNCI6MTY4NzI5MDI3Nzg3NCwiNDUiOjE2ODcyOTAyODU5MTgsIjIiOjE2ODcyOTAyNzc4NzQsIjQiOjE2ODcyOTAyNzc4NzQsIjM5IjoxNjg3MjkwMjc3ODc0LCI3IjoxNjg3MjkwMjc3ODc0LCI2NCI6MTY4NzI5MDI5MTQyMX0
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-0582ffcc-029a-4b6a-9d8a-cee11ea1f0b8-005%22%2C%22nxtrdr%22%3Afalse%7D
.audrte.com/ Name: arcki2_adform
Value: 1235390588561432912!20220908!1687290291485
match.sharethrough.com/ Name: AWSALBCORS
Value: IS58W2Wmmnb9AIkxK/PSEVRpyq9KA/NUxDUAPIYzcEnz1LqwAXQilyjgHYYJToqJPaD6MpXQAqCGtR8NSuILCH2eylMDSign4agYRWeMcQ5DTex8HOYxt6xJsll5
.id5-sync.com/ Name: callback
Value:
.richaudience.com/ Name: avcid-id5-uid
Value: ID5-9d3b-cNEle4rsKdWlUxZXORwyV92bcua7tnRHP2z8A
.adnxs.com/ Name: anj
Value: dTM7k!M4.FEVNsVF']wIg2E?!H<NohNRJzTn[^/LD$25bihbm')'8h?3][dr4hDv93Nkxk>/7Ve5%!4aTHwLP2FzK)T-A+r`T]Y^dG!+ve+.<Q!@%SLV2i6j
.adnxs.com/ Name: uids
Value: eyJ0ZW1wVUlEcyI6eyJzbWlsZXdhbnRlZCI6eyJ1aWQiOiI1OTIxMzRjODY0ODNiMjc1MDkyMWFjMmUwOTc3YmNiNiIsImV4cGlyZXMiOiIyMDIzLTA5LTE4VDE5OjQ0OjUyWiJ9fSwiYmlydGhkYXkiOiIyMDIzLTA2LTIwVDE5OjQ0OjUxWiJ9
.connectad.io/ Name: uid
Value: WO8dHzCc5VwX4NQ47Y5w94la1DNoDjurpcn5rgPp
.openx.net/ Name: pd
Value: v2|1687290292|vMgavPkWgyiK
.rubiconproject.com/ Name: audit
Value: 1|mFVHqHkj5bHdEvr2P5B+eHWpjeOxZPlL0jVnHtKqHxSdykjWRlMVmlSpWN2rA5OEhYgksQwCcn6WhfNqUpDWVT79QniQXr/UKTko5zrvng4+b/wt+f4s/Q==
.adsrvr.org/ Name: TDCPM
Value: CAESFQoGY2FzYWxlEgsI5MfupJr0-DsQBRIbCgxzaGFyZXRocm91Z2gSCwi-jdiomvT4OxAFEhQKBXRhcGFkEgsI_pLcqZr0-DsQBRIZCgpsaXZlaW50ZW50EgsItuakr5r0-DsQBRIWCgdydWJpY29uEgsInu77sJr0-DsQBRIWCgdzdng5dDUwEgsIuKWAuZr0-DsQBRITCgRrcnV4EgsI-I_C5eDB7TsQBRISCgNhYW0SCwimgJ_m4MHtOxAFEhYKB2JsdWVrYWkSCwjo_9_HmvT4OxAFEhUKBmdvb2dsZRILCNDoi8ua9Pg7EAUSGQoKcmlnaHRtZWRpYRILCNDoi8ua9Pg7EAUYASACKAIyCwjA4vGdsfT4OxAFOAFaDnNtYXJ0LWFkc2VydmVyYAI.
.openx.net/ Name: univ_id
Value: 537072971|db51a350-c421-4780-94b8-db6155d007ec|1687290292914034
.dotomi.com/ Name: DotomiTest
Value: 648cdd480c16184a
.id5-sync.com/ Name: 3pi
Value: 2#1687290283692#-1720364047#3321274862842215126|3#1687290282367#2039958890#5f956492-01a9-4900-b96e-6cf0342c9990|102#1687290289217#-254688341|264#1687290283324#-2066749461#db51a350-c421-4780-94b8-db6155d007ec|104#1687290291687#-1575874826#2491035f-3b91-450a-bf47-d3da43a3fb7b|136#1687290292784#1243829995|10#1687290291821#571176425#1235390588561432912|108#1687290282844#-1426717703|429#1687290283132#-1717974571#479CC621-B2E0-490D-8915-42055EBBC0EB|464#1687290282110#-445355574#1bf3f028-e066-42b6-824a-9d159668ee75-tuctb8b8726|112#1687290284240#-1213563798#885894C13F35428C|434#1687290291159#158063526|18#1687290291359#1136148941|821#1687290292628#-1079607020|441#1687290284477#1917164360#u_505daddb-b9f3-4eff-a7a6-25c842c0512d|155#1687290291529#99191751#AAEDUk7JJAMAACROtOIu9g|285#1687290292928#1112755767#LJ4P2KW9-15-LLQ7|286#1687290290964#952788847
.id5-sync.com/ Name: cf
Value:
.id5-sync.com/ Name: cip
Value:
.id5-sync.com/ Name: cnac
Value:
.id5-sync.com/ Name: car
Value:
.id5-sync.com/ Name: gdpr
Value:
.smilewanted.com/ Name: sw_user_params_infos
Value: L88fxwBJ%2BxNh%2F7Y1RkgxW4q6%2BZXzQ3ijcTMUnig8N6BzT9jNKhlWSRZxo160f9ijdYX7txM1hsGpJUkIEvtsikkWagnN8d%2Fumn%2BltQEg2AADLIjbn2eYb7X1Jvae6%2FhcTbG%2FfEeEdxHk4j%2Fbl6vbPoydRJGLC%2Flnx%2Fun7ik3K1rRxPQ%2FWiEB6iRnoX6e4LVM9pgDnhrjmUhu3o75%2FqDwTIdm8KHvcPjhohkcNJYdef4Z51WglS61dPDnkntwRHIsq9%2BnNV0shIpQnxJYvmqEXuOf4VLtRhuCbDYK51I%2FsyObWtlm8aLFKe3KtTqa%2BK23TYatlGjE9ngk6OBZ1pr5lyLsq4Y%2BVus%2FtwqHvLUBfABgeRVIiCzP%2FaT5JxJpDOHRASaW0q265gBAC%2B3wzLJGSyf%2BSft4x%2FScZHG1qxfkgVhi0MFu%2FW0w14tOqDd87RREPzwnShWUnhLcUNYwwbq5fWQFwgMUKzD3CdFqbxhLGfjRAApNoBVuetd9fqYZV5zC5hwXe1KEajh2J1eSz8OeLTrzzidmuQ7nLWvgg2nZhz%2BphC9b0wmV5e3LKPeFFilQ4EJEkEtdZrOO2W%2F4HqcF6liuqeikrVJwPhZPSs8VODchciK9vPeaYgXGPVgR2O8%2F%2FiphoHC2z2ytKBI0lKhBWFGEGlLoSdA1zKJsfeLnmP2JGkMaTjGnsDkaZXGqwuYDCf8gJRKVLODCbqVxTJPYaA%3D%3D
.360yield.com/ Name: um
Value: !79,3XaXgoLeWLAOOI7m0UrIoJrG.uYVPdMQ71NwP.jhoDN3Zi9RB35-HYyepXr2uDT0T7P6HTjX0-MagYDF,1695066291!313,3XaXgmzhfzphAk-yCIOVS4Xsm9LTo37cIVF1oMIH5ZuaG5wuJJrQl2OKvW9jqX37wqlxTTni-qPrG5QC,1695066293
.360yield.com/ Name: umeh
Value: !79,0,1749498291,-1!313,0,1749498293,-1
.company-target.com/ Name: tuuid
Value: 4ed84149-74cb-4089-8a62-fd46691017b4
.company-target.com/ Name: tuuid_lu
Value: 1687290293|ix:0
.connectad.io/ Name: id
Value: eyJpdiI6Ik4yMmVNbTlQem8zRkxkNDdmbzJSMGc9PSIsInZhbHVlIjoiUEpRbVRFdWc0Sno4ZDQ0V3pDSFFwSnJzZnpTN1BRODdMbHBDQlZrWkhtV0tCRUJCbGtuUWRmSXNZZ0tqVDhVWDZXRmtFTm1vY3ljbllpRU5CWVY0YkZzV1dlRkFUUW5wV1pxYXZ2cVN1ZjZDcFBwaUpFMHMxWXJzYVhhK29WT0FISzduXC9NYk1DTHMwZXJkUno0MkFZOFRyMFl3bUl0RHlTRSs5YnpmWXpWU2xSNFB4VHlWeHNlamU4ZWo1ZFJZXC95eXZJZ2FXTGR2Uk5MZHJqOFhtXC9PT0k4UDY3aXQ5THQ2ZlVFYTVxRStibExRQkdQSTNqNWJmbkpjMjFuY3lNblpPd3NmT28yRE02cTl2K05La2hQWmc9PSIsIm1hYyI6ImUyY2E1NjRkZGFjZTg3OGZkMjdiZjM5ZWM4OTEyNjRmZDU2ZmI4ZGZhNmE5ZTI2NDRjMjRhNmJjNmE2YTY4N2UifQ%3D%3D

56 Console Messages

Source Level URL
Text
javascript warning URL: https://cmp.osano.com/16A1AnRt2Fn8i1unj/1edc45d9-1a78-48b2-9035-037b31df744a/osano.js(Line 1)
Message:
Failed to execute 'write' on 'Document': It isn't possible to write into a document from an asynchronously-loaded external script unless it is explicitly opened.
javascript error URL: https://www.mercurynews.com/2023/06/20/meghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc/
Message:
Access to XMLHttpRequest at 'https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768236&size_id=15&alt_size_ids=9%2C10%2C54&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=ad84d507-3304-4eb1-b802-823505a908ec&l_pb_bid_id=4c8df310a0f9ee&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=ad84d507-3304-4eb1-b802-823505a908ec&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&slots=1&rand=0.9979962081309603' from origin 'https://www.mercurynews.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=15594&site_id=469134&zone_id=2768236&size_id=15&alt_size_ids=9%2C10%2C54&us_privacy=1---&rf=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.domain=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F2023%2F06%2F20%2Fmeghan-markle-earned-more-than-the-weeknd-for-just-12-hours-work-ex-spotify-exec-tells-bbc%2F&tg_i.pbadslot=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&tk_flint=pbjs_lite_v7.46.0&x_source.tid=ad84d507-3304-4eb1-b802-823505a908ec&l_pb_bid_id=4c8df310a0f9ee&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=ad84d507-3304-4eb1-b802-823505a908ec&rp_maxbids=1&p_gpid=%2F8013%2Fmercurynews.com%2Fthings-to-do%2Fentertainment%2Fcube1_rrail_atf%231&slots=1&rand=0.9979962081309603
Message:
Failed to load resource: net::ERR_FAILED
network error URL: https://sync.adkernel.com/user-sync?zone=181093&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dmdp%26i%3D%5BUID%5D&gdpr=0&gdpr_consent=&ccpa=
Message:
Failed to load resource: the server responded with a status of 400 (Bad Request)
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://eus.rubiconproject.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
javascript error URL: https://sopalk.com/r/p.html?f=adcnnnssu&e=1918623590599
Message:
Access to XMLHttpRequest at 'https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283232&tk_flint=pbjs_lite_v7.19.0&x_source.tid=1c0725b7-bbae-4f71-a79e-c9e9820d946e&l_pb_bid_id=486b583cd1b4f9&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.3436870005164454' from origin 'https://sopalk.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://picrew.me' that is not equal to the supplied origin.
network error URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283232&tk_flint=pbjs_lite_v7.19.0&x_source.tid=1c0725b7-bbae-4f71-a79e-c9e9820d946e&l_pb_bid_id=486b583cd1b4f9&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.3436870005164454
Message:
Failed to load resource: net::ERR_FAILED
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
javascript error URL: https://sopalk.com/r/p.html?f=tnhfdisl&e=1918623590599
Message:
Access to XMLHttpRequest at 'https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283247&tk_flint=pbjs_lite_v7.19.0&x_source.tid=0db98821-01a7-4eb3-9efe-36458cad46c4&l_pb_bid_id=12ce8a2816ff053&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7775279640995427' from origin 'https://sopalk.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://en.hiddenremote.com' that is not equal to the supplied origin.
network error URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283247&tk_flint=pbjs_lite_v7.19.0&x_source.tid=0db98821-01a7-4eb3-9efe-36458cad46c4&l_pb_bid_id=12ce8a2816ff053&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7775279640995427
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://sopalk.com/r/p.html?f=vciuxsaem&e=1918623590599
Message:
Access to XMLHttpRequest at 'https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283244&tk_flint=pbjs_lite_v7.19.0&x_source.tid=a1a3b79f-3b5e-44ff-a7d1-0fccf3307aee&l_pb_bid_id=12ee1680f1af3b1&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.13947838485035424' from origin 'https://sopalk.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://metrozone.newsroomlabs.com' that is not equal to the supplied origin.
network error URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283244&tk_flint=pbjs_lite_v7.19.0&x_source.tid=a1a3b79f-3b5e-44ff-a7d1-0fccf3307aee&l_pb_bid_id=12ee1680f1af3b1&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.13947838485035424
Message:
Failed to load resource: net::ERR_FAILED
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
javascript error URL: https://sopalk.com/r/p.html?f=bdaakmyj&e=1918623590599
Message:
Access to XMLHttpRequest at 'https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283241&tk_flint=pbjs_lite_v7.19.0&x_source.tid=b20193e2-91b2-4a34-8ded-ca4ad5c8f749&l_pb_bid_id=63673bb9c18d17&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.034117453226497396' from origin 'https://sopalk.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://www.moneyscapes.com' that is not equal to the supplied origin.
network error URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283241&tk_flint=pbjs_lite_v7.19.0&x_source.tid=b20193e2-91b2-4a34-8ded-ca4ad5c8f749&l_pb_bid_id=63673bb9c18d17&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.034117453226497396
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://sopalk.com/r/p.html?f=cbyfcuv&e=1918623590599
Message:
Access to XMLHttpRequest at 'https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283237&tk_flint=pbjs_lite_v7.19.0&x_source.tid=f81d3ba0-e40c-439d-a5ee-69fa1144b012&l_pb_bid_id=103c28b99e5f1fb&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5918013549765238' from origin 'https://sopalk.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://www.acordacidade.com.br' that is not equal to the supplied origin.
network error URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17210&site_id=397268&zone_id=2226136&size_id=15&p_pos=atf&us_privacy=1---&rp_schain=1.0,1!adpone.com,1142c9f178fb6cbc02b7,1,,,&rf=mercurynews.com&tg_i.page=https%3A%2F%2Fwww.mercurynews.com%2F&tg_i.domain=mercurynews.com&tg_i.pbadslot=adpn-adtag-1687290283237&tk_flint=pbjs_lite_v7.19.0&x_source.tid=f81d3ba0-e40c-439d-a5ee-69fa1144b012&l_pb_bid_id=103c28b99e5f1fb&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5918013549765238
Message:
Failed to load resource: net::ERR_FAILED
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
javascript error URL: https://8proof.com/app/rtbmarkup/5111?id=515457626221&ctd=110096&crid=1178&ap=ZJIBrgAGQAAJiBH-AASP1zOnRTMZlV_S4Qn6Dw
Message:
Access to font at 'https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-800.woff2' from origin 'https://8proof.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-800.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://8proof.com/app/rtbmarkup/5111?id=515457626221&ctd=110096&crid=1178&ap=ZJIBrgAGQAAJiBH-AASP1zOnRTMZlV_S4Qn6Dw
Message:
Access to font at 'https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-600.woff2' from origin 'https://8proof.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://cdn.8proof.com/ads/assets/fonts/montserrat-v25-latin-600.woff2
Message:
Failed to load resource: net::ERR_FAILED
other warning URL: https://www.googletagservices.com/dcm/impl_v96.js(Line 77)
Message:
Unrecognized feature: 'attribution-reporting'.
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
network error URL: https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://rtb-csync.smartadserver.com/redir/?partnerid=147&partneruserid=45bb695b-34f1-45bc-b104-fd1bfa86c044&gdpr=0
Message:
Failed to load resource: the server responded with a status of 503 (Service Unavailable)
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://ads.pubmatic.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').
security error URL: https://htlbid.com/v3/mercurynews.com/htlbid.js?ver=6.2.2(Line 1)
Message:
Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://www.mercurynews.com') does not match the recipient window's origin ('https://sopalk.com').

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src data: 'unsafe-inline' 'unsafe-eval' https:; script-src data: 'unsafe-inline' 'unsafe-eval' https: blob:; style-src 'unsafe-inline' https:; img-src data: https: blob:; font-src data: https:; connect-src https: data: blob: wss://realtimeeventfeeds.viafoura.co wss://sub.viafoura.co; media-src blob: data: https:; object-src https:; child-src https: data: blob:; upgrade-insecure-requests; block-all-mixed-content;
Strict-Transport-Security max-age=31536000;includeSubdomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

002eac1937dfa0ab9d464dad4396d7c8.safeframe.googlesyndication.com
85131152eb682e3476b7fd12a88398f7.safeframe.googlesyndication.com
8proof.com
a.audrte.com
a.sportradarserving.com
a.tribalfusion.com
a869.mercurynews.com
aax-eu.amazon-adsystem.com
aax.amazon-adsystem.com
accounts.google.com
acdn.adnxs-simple.com
acdn.adnxs.com
ad.360yield.com
ad.doubleclick.net
ad.mrtnsvr.com
ad.turn.com
ads.betweendigital.com
ads.creative-serving.com
ads.playground.xyz
ads.pubmatic.com
ads.stickyadstv.com
ads.yieldmo.com
adservice.google.com
adx.adform.net
ajax.googleapis.com
amazon-tam-match.dotomi.com
ams-pageview-public.s3.amazonaws.com
ap.lijit.com
api-mg2.db-ip.com
api.viafoura.co
az416426.vo.msecnd.net
b-code.liadm.com
b1sync.zemanta.com
bat.bing.com
bcp.crwdcntrl.net
beacon.krxd.net
beacon.lynx.cognitivlabs.com
beacon.sojern.com
bh.contextweb.com
bidder.criteo.com
bpi.rtactivate.com
c.amazon-adsystem.com
c1.adform.net
casale-match.dotomi.com
cdn.8proof.com
cdn.adnxs.com
cdn.auth0.com
cdn.callrail.com
cdn.confiant-integrations.net
cdn.connectad.io
cdn.czx5eyk0exbhwp43ya.biz
cdn.doubleverify.com
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.jwplayer.com
cdn.p-n.io
cdn.parsely.com
cdn.pranmcpkx.com
cdn.prod.uidapi.com
cdn.taboola.com
cdn.viafoura.net
cds.taboola.com
ce.lijit.com
choices.trustarc.com
choices.truste.com
cm.adform.net
cm.adgrx.com
cm.g.doubleclick.net
cmp.osano.com
cms.quantserve.com
connect.facebook.net
consent.api.osano.com
contextual.media.net
cookie-matching.mediarithmics.com
core.iprom.net
crb.kargo.com
crcdn01.adnxs.com
creativecdn.com
cs-server-s2s.yellowblue.io
cs.admanmedia.com
cs.iqzone.com
cs.media.net
cs.yellowblue.io
csync.loopme.me
csync.smilewanted.com
d.adroll.com
d.turn.com
dc.services.visualstudio.com
digitalfirstmedia.blueconic.net
dis.criteo.com
dmp.adform.net
dpm.demdex.net
dsp.adfarm1.adition.com
dsp.adkernel.com
dsum-sec.casalemedia.com
dsum.casalemedia.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
fp-cdn.azureedge.net
g2insights-cdn.azureedge.net
geo.privacymanager.io
gocm.c.appier.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
hb.adpone.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
htlbid.com
i.clean.gg
i.liadm.com
i.viafoura.co
i6.liadm.com
ib.adnxs.com
ice.360yield.com
id5-sync.com
idsync.rlcdn.com
ih.adscale.de
image2.pubmatic.com
image4.pubmatic.com
image6.pubmatic.com
image8.pubmatic.com
images.taboola.com
imprnjmp.taboola.com
insight.adsrvr.org
inv-nets.admixer.net
io.narrative.io
ipac.ctnsnet.com
jadserve.postrelease.com
js.matheranalytics.com
js.moatads.com
k.p-n.io
launchpad-wrapper.privacymanager.io
launchpad.privacymanager.io
live.rezync.com
load77.exelator.com
loader-cdn.azureedge.net
loadm.exelator.com
maps.googleapis.com
match.adsby.bidtheatre.com
match.adsrvr.org
match.deepintent.com
match.prod.bidr.io
match.sharethrough.com
match.taboola.com
matching.truffle.bid
mug.criteo.com
mweb.ck.inmobi.com
nym1-ib.adnxs.com
onetag-sys.com
p.rfihub.com
p1.parsely.com
pagead2.googlesyndication.com
paywall-ad-bucket.s3.amazonaws.com
pippio.com
pips.taboola.com
pixel-eu.rubiconproject.com
pixel-sync.sitescout.com
pixel-us-east.rubiconproject.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.sitescout.com
pixel.sojern.com
pixel.tapad.com
pixel.wp.com
player-files.remixd.com
pm-widget.taboola.com
pm.w55c.net
pmp.mxptint.net
polyfill.io
pr-bh.ybp.yahoo.com
prebid.smilewanted.com
prg.smartadserver.com
prod-dfm-proxy-connext.azurewebsites.net
prodmg2.blob.core.windows.net
protected-by.clarium.io
pubcast-files.remixd.com
pubmatic-match.dotomi.com
pulsepoint-match.dotomi.com
px.ads.linkedin.com
px.owneriq.net
rp.liadm.com
rp4.liadm.com
rtb-csync.smartadserver.com
rtb.adentifi.com
rtb.gumgum.com
rtb.mfadsrvr.com
rtb2-useast.marketiq.com
rules.quantcount.com
s-jsonp.moatads.com
s.ad.smaato.net
s.amazon-adsystem.com
s.btstatic.com
s.company-target.com
s.ntv.io
s.thebrighttag.com
s.tribalfusion.com
s.w.org
s0.2mdn.net
sb.scorecardresearch.com
secure-assets.rubiconproject.com
secure.adnxs.com
secure.quantserve.com
securepubads.g.doubleclick.net
session.mercurynews.com
simage2.pubmatic.com
simage4.pubmatic.com
sli.mercurynews.com
sopalk.com
ssbsync-us.smartadserver.com
ssbsync.smartadserver.com
ssc-cms.33across.com
ssum-sec.casalemedia.com
ssum.casalemedia.com
stags.bluekai.com
static.criteo.net
static.smilewanted.com
stats.g.doubleclick.net
stats.wp.com
sync-amz.ads.yieldmo.com
sync-eu.connectad.io
sync-pm.ads.yieldmo.com
sync-t1.taboola.com
sync-tm.everesttech.net
sync.1rx.io
sync.adkernel.com
sync.bfmio.com
sync.connectad.io
sync.crwdcntrl.net
sync.go.sonobi.com
sync.ipredictive.com
sync.mathtag.com
sync.outbrain.com
sync.richaudience.com
sync.smartadserver.com
sync.srv.stackadapt.com
sync.taboola.com
sync.targeting.unrulymedia.com
sync.teads.tv
sync.technoratimedia.com
sync.tidaltv.com
synchroscript.deliveryengine.adswizz.com
t.adx.opera.com
t.pswec.com
tags.bluekai.com
tags.rd.linksynergy.com
tags.remixd.com
tg.socdm.com
thrtle.com
tlx.3lift.com
token.rubiconproject.com
tpc.googlesyndication.com
tps.doubleverify.com
tpsc-ue1.doubleverify.com
tr.blismedia.com
trace.mediago.io
track.elissa.myastrology.com
trc.taboola.com
u.openx.net
uipglob.semasio.net
um.simpli.fi
ums.acuityplatform.com
unpkg.com
ups.analytics.yahoo.com
us-match.taboola.com
us-trc-events.taboola.com
us-u.openx.net
us-vid-events.taboola.com
us.ck-ie.com
usermatch.krxd.net
usersync.gumgum.com
vidstat.taboola.com
visitor.omnitagjs.com
www.facebook.com
www.foo.software
www.google-analytics.com
www.google.ca
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.i.matheranalytics.com
www.mercurynews.com
x.bidswitch.net
x.dlx.addthis.com
z.moatads.com
cdn.8proof.com
fastlane.rubiconproject.com
ice.360yield.com
protected-by.clarium.io
104.117.182.40
104.117.46.235
104.127.172.242
104.18.25.185
104.26.4.15
104.36.115.111
104.76.100.229
107.178.244.119
107.178.250.234
107.178.254.65
108.138.106.17
108.138.106.32
108.138.107.138
108.138.126.121
108.139.29.51
13.225.214.63
13.33.60.51
13.35.93.41
13.35.93.44
13.85.16.224
137.184.240.117
138.201.8.249
141.226.224.32
141.226.224.48
142.250.176.194
142.250.64.70
142.250.80.34
143.204.146.67
151.101.1.44
151.101.129.108
151.101.65.108
151.101.66.49
162.19.138.119
162.248.18.34
162.55.120.196
169.197.150.8
172.104.105.5
172.67.10.198
173.231.178.116
174.137.133.32
174.137.133.49
18.164.101.60
18.164.116.69
18.164.116.7
18.164.96.64
18.198.251.95
18.215.8.84
184.27.80.19
185.167.164.39
185.184.8.90
192.0.66.2
192.0.76.3
192.0.77.48
192.40.39.223
195.244.31.10
195.5.165.20
198.148.27.139
199.127.204.171
199.38.167.131
20.42.73.140
20.60.62.4
20.85.134.6
202.241.208.56
204.62.13.72
207.198.113.230
207.198.113.90
213.19.162.90
216.22.16.1
23.105.12.143
23.105.12.172
23.105.14.106
23.196.180.24
23.200.197.46
23.52.163.93
23.54.68.184
23.54.68.197
23.54.69.151
23.54.69.53
23.58.157.143
23.92.190.69
23.92.190.74
2600:1400:9000::6875:b641
2600:1f18:1c96:4103:9ee8:bc24:c1e4:34c4
2600:1f18:44f0:4847:757a:9f73:587:7107
2600:1f18:4e9:5a01:1182:3903:eb81:31e2
2600:1f18:61c0:2204:b513:b8fc:2d8f:8df9
2600:1f18:730:b130:6259:cdb:fde4:77dc
2600:1f18:ed:550e:4106:3062:270c:cbbd
2600:9000:21dd:5800:6:44e3:f8c0:93a1
2600:9000:21dd:d200:8:2ae1:d740:93a1
2600:9000:2209:4a00:1b:5138:8a40:93a1
2600:9000:2209:d200:1:a3fa:7cc0:93a1
2600:9000:23cb:7c00:8:8845:1500:93a1
2600:9000:2510:aa00:3:b7e:8940:93a1
2600:9000:2511:1000:10:474e:104a:2961
2600:9000:2511:a00:a:e047:753:be1
2602:803:c002:200::42
2603:c020:400d:3000:bf17:cd18:9a23:846c
2604:9e00:1:129::2:a01
2606:2800:11f:17a5:191a:18d5:537:22f9
2606:2800:11f:1cb7:261b:1f9c:2074:3c
2606:4700:10::6816:3556
2606:4700:10::ac43:8ae
2606:4700:20::681a:a19
2606:4700:4400::6812:220a
2606:4700::6810:7eaf
2606:4700::6812:18ad
2606:ae80:1451:17::1400
2607:f8b0:4004:c08::9d
2607:f8b0:4006:80a::200a
2607:f8b0:4006:80d::2001
2607:f8b0:4006:81c::2004
2607:f8b0:4006:81c::200a
2607:f8b0:4006:81d::200d
2607:f8b0:4006:81e::200a
2607:f8b0:4006:820::2003
2607:f8b0:4006:820::2008
2607:f8b0:4006:821::2001
2607:f8b0:4006:822::2002
2607:f8b0:4006:822::2003
2607:f8b0:4006:823::2002
2607:f8b0:4006:823::200e
2607:f8b0:4006:824::2002
2607:f8b0:4006:824::2006
2620:100:a001::18
2620:100:a001::4
2620:100:a001::c
2620:112:f002:bbbb::21
2620:112:f002:bbbb::23
2620:116:800b:21:4cb8:1820:80ca:50f7
2620:1ec:21::14
2620:1ec:c11::200
2a02:6ea0:c400::12
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
2a04:4e42:400::300
2a04:4e42::282
2a04:4e42::485
3.13.23.188
3.210.36.192
3.213.218.94
3.213.224.199
3.218.133.69
3.225.113.174
3.227.148.228
3.227.188.131
3.234.237.251
3.5.28.156
34.102.163.6
34.102.253.54
34.111.113.62
34.117.228.201
34.171.234.26
34.196.107.2
34.196.255.49
34.200.65.202
34.203.16.231
34.206.101.164
34.228.89.16
34.229.3.43
34.230.233.1
34.237.129.106
34.95.69.49
34.96.105.8
34.96.71.22
34.98.64.218
34.98.67.3
35.171.239.119
35.186.193.173
35.190.38.143
35.190.60.146
35.207.24.140
35.208.249.213
35.211.178.172
35.211.233.246
35.214.152.43
35.71.131.137
35.71.139.29
37.157.6.233
37.157.6.243
38.98.69.175
44.206.150.230
50.57.31.206
51.222.39.187
52.0.201.47
52.1.91.70
52.116.53.150
52.2.47.221
52.20.224.27
52.203.194.180
52.205.167.202
52.216.108.235
52.40.223.220
52.44.244.58
52.46.130.91
52.5.243.49
52.70.0.189
52.72.123.193
52.73.23.114
52.85.61.107
52.85.61.61
52.85.61.67
54.161.170.61
54.162.81.74
54.172.46.145
54.205.17.152
54.229.88.75
54.36.150.180
54.84.229.185
54.84.64.172
54.92.222.20
63.251.28.233
64.202.112.223
64.227.64.62
67.202.105.21
67.220.228.202
68.67.160.117
68.67.160.75
68.67.179.89
69.166.1.10
69.90.254.78
70.42.32.191
74.119.119.139
74.119.119.150
74.121.140.211
8.2.108.175
8.2.111.13
8.28.7.81
8.28.7.82
8.28.7.83
8.28.7.84
8.43.72.97
8.43.72.98
80.77.87.161
82.145.213.8
85.114.159.93
96.46.186.57
012a69ca45064c59cd497a10a916a6100805aa44c6f9a4297deb131d6de49ed8
01407ea5c2e7ca3f46076f1f2f8df4b6e998580414789406dff50f183497f6b7
0152a088a37330522c1458229707cbc27e42f802e1ba385d887b8a0069927618
01d6389de5581a2a3eb0cd4d6a05cb136bf07d221306f89173a080c73a38e392
025d3def2f9f980962e81f1bf2f4196df1aa87fb9acbfc1d2d5e21fd5c3c1206
034d5dcc8f23fff30ab2b7836559516e103b3c54635705c4f037c92722b11753
03d9c6282533912a324c1d6f7c0c06583bed3f2c3a4a2331a6c36df3602faf52
041f41b6b98e101febe7d24b8d7fdd9fd696dabad0fbe296c978272491c2a791
04819970a784f5b35e5618e45433e7813caeabefca573681b08b4efe83a1c2f1
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05486206a996712b904973ec59a3f5c2aa84eb26bf6e739c7275e7b59731653d
058b2f66dcdfde7a5275318c3ba20a88024351adec38c6ab9892d379690b58b4
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
0859f5f9bf49348ef81d01f953d520c10a2a857961ef1bfad4a7903609889de5
08f0465386d9897c95370a004f5251b304dc4f94a73541cccd1ee87c02de2f60
093d94d4b660253c55e87d4503dffcb6cedc8f222f9d85d1faa68ff619ac9d3e
09b6e418da68639208bd22fc77a5467dc6a6235d1eaacf70e6d4b7c739257f94
0a1f6c413343d731fab211dffb1dbae0a1a52cab4f8c7b2ae5430b50103bae04
0a579a5090af8bde46a635d027562e51f8b6efea345ce2655549b13bcc7b008b
0b0738ca18af8998645608545bac36ebfbbc8719021e6c46c0ed46de1306a66c
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0e63b41633f702445beda74ed05507a27af4838c324df394a779c4c823e15f0e
0e74e6ac26ea124d4b1aec4be40188ed8124fdca0371b210a14fcf68a953302e
0e8e9fab28b24199f9d2b90a2b0996495b9d68cbe71550e5c4780bbf7028296f
0f1fa96d6743abf4c7cd9df01295b33848f716814f1bc3af015180018ac4ba36
0f27b15848fb3a09df5fa1ba8e2ae9a80ca73faca61455767cd28318fd3c2c6b
1036836d0835d46da4393dde5d84afeb6769620c68a604faa945e78820bc922f
107056ea90d27efb0e0266bf5cd1ae3b8257f1585851bda2a3201171b88bbab8
123830b3c1bb951b81bee61657d5ff2d7061c67316a4210df730462d093b0a23
124f165a1243b48bd2ac21cebd8852c818c5deb7692fbfb5c80f5d5b72625da9
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
12b5eaccd8a9d81a6a12512566d2b72aa7c100b4a261a08ee6aae4679a9e36b4
1313e544d95566c0ed767f40117a8287940c2856fb450d6a4224b8db33a97902
136a576886a9ae3b5d55278a3e69a1fcc0a2189dfbf77ec41787742f260e5526
141edd521ee7dc499dfaaa8b9cebd09a7be6cba128d788b5a5388232eeabc462
1436436e0c6c4ca6648aff74a2afe507a59e19cb76923ebd8c1b779778627450
146ce9984266770e5e96199e4e59ca1fb5fede14f70758bcbf87654dac300667
14e71be3ff5aa2e7773210530b6f25ac38218c1833c4efec611f8c89e650db52
14f3a2330f6d02bcd5407635a03c7ab8ed1aa494914c05881137c5e86ae20acf
176df1038f84f14d1d2ec33b51af8cef8034b6ebf27106f9b716f714d560e882
182abb62bdb40059dbda691bf6631cf6b471499a85971a5fd04832453d7b4141
1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002
189b8ed64093b12937354b2ef71ccf1df59690d90432241a10fe1cb25000acba
196a17c1b8e4d675d0d5d6be75febe01dcb43f66529e9054d843591a50459bf2
19cf792a649556b6e99d788a69b1e501dc0748c010896e4fd4081eca8ab0983c
1a4e3ef2398b9b2cb81b94063098e308139fa0cc0635b8c26ee4fb303a28e21e
1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
1c6579a152145ab4c6708dbacf4092ff71d4ccb3f7e760516c04fd99b7ef53ea
1d4a78769df11981630c482bfe090ec752e4a7401e15e79abd8d351f6e034903
20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a
21b580c0e786d0ff2b8ef69d2808f19c17e9106f4effdf1771475ac870c81ea1
22572ad7de28c9255a9657579b2d739869075cf10c7ebe6d76c559ac7e6d9cdb
22cfe8b4747da702aee268f347c579216ffc2e96a4cf4ced6b5f7388d99c5841
24999918b7aa7fd5adeca29162085186c3e7cdee5914709c9a927b46b48f05b9
270fb1f5320e32a7e0b8af9d3102063d8eb8950f4feb0ce3bb6c00536c1daa60
278eedcc7c647c92881450517e7880aebceaccfa25b75843a9f17d68fbdc65be
27e29a5aebbbc2d82b6f7d9dbbf03ced7ecaf592adf68338a02aff332b3e7bd5
28519471dca273ae1ae4e71f7312ed85780fb03588532aab4845a6cf41740043
2943a138fb8248f4ef8d8ac14a988ef46f8bb5d3aa964ff227082c1651e46dbf
29f9c2a86df189e26724a899022d938c2c86c55dfeda4d9d5392a3afefa6e9fc
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2aa50c9706f2175ff0a141b65a82f4c0a8907f75779f00d9d29d31a09c58121f
2c95bbac8e167a1fd9297768d9c45d1f50db54733b750ae889b3a5efd2fae8fa
2d199b9d8dc7886837cbfd12c9e8ddae7e28f5c375d564b31bf732a320921435
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2f092f236f905de588f781555bffe9b9fba9e85a3bb451441ca86fd8ef9a01ff
2f218961fc995f27f5868268ca3f765d4e7066eb6144139ce5b9eefe9b9ad443
2f218987261e49e368f7f85f9e5bf66f49f62032e96bb064c43064df8fc4e2fd
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2f8d80d02c9817b240d7a7e01ff520bcd4babcb3fcaaa662c9cf0677d0551a44
30dd4d046ee0a560951014c2c3f71fb0b620af27279bd7c5ff8b4ac877214291
31c86114d8c9683bade57e627634f040284e99a601deb292b961108e5d831415
320a526c59206598fcf37bc7e6950aa443a2d576bb2667a6bad7517d756f438c
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32f365b7f2196ed2d801e5b6570e160b72767a2fa3ec58b516955e5b3caccba3
3333d3f60d4bab99e3b9765289a0cb56863e6dc65f15e65a7457d187dafb4ac4
35738f48bead5920d9d6918ac2199c0b378b8777b81ddbdf4fcf379a523ee801
36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0
37a534b757835254a2c961605454fd373e3c0dc789a8b7519b82868fa3d93346
38918e8452a9b201d47041349b1e7636d806873297665f71eb3964142cbeb4d9
3916390d4395ed16641c0e23d5e5a1bef9de6ce71b02c3941c0ee6f2d899c806
392c32f20b9f867852a946a6ed1c5e21476df9619083548b6585d80a3b5f9bd4
39b076e4bb4fab9b8a142499cf6155f8c128464974691a04de7e764f71b72618
3c22667dfaf40683c813ef6ef656953f5268a28a097df381857ad09ef21a206c
3cef1864f3b4a587c446729a5ee0eb8ae906ec76154e956b797e467c653d0024
3d5b8643f364025e855cd7f47749a9cea23d3fba8ccdc1ee252d7a8fee9fed6d
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3d7a16ff1ffd8d8507acd6f1ac3f27609a4e979b0a8e37474d3e0ba43e20fe3c
3d7eab053e530796daa6d43d9d197863a516407ac80a18acafd39242cca53d2a
3e7d49f24d56db02c7baca8ae3a17555c2e527571450e8c24c77b453407e267a
3e812632066a1fa29f79d516c7e9b729bf8d96751d67c0ba607a7e004d8e5c97
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3f4a597222ffe64626a8a60480c9e7369729e446ae5b129795f1922ceb458eda
3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390
41c28767173fcc7e5858fe1e7ec9644a6e1c2a58a3c41b630463bf85ad063f64
4217045a8d701cac3b4a766a11076e7cc5342087464a8a6e3cc7e4f9feec09a3
42cda85ec144d11030fa9e1516a35645dbb153580ba01934f9c24b659cfeb841
42d8c6aea646efc28475231137b1fdd1e216d02563c548fd789e9ae7ae5f8e65
43129d7a4f2d9953ac97cf492c5ef5e3bd5ab06b34e5998b93b386d6485f2936
4424132c76bd3b942b9a4b0dc628dc4cd5826b75022aca28ad4ae6a696f35437
4518dbd683cbb1523ce069867d2a9405d3b5073244568afc7a9336f9007dfca9
462fcc52ef8e307cfd803931192a5e698894d38c6090ce2b030364c1137f1655
463b965e90a6c1e92161047e09f18a7b0c5bfe39c59de875536a744922f18285
4648be38834a1fbce25220f7f42ba34c7f01b7638c059dadae417050066e69c0
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
470a2429c3042f378756072ec008c3e0988434499cfd8c211f59ffb9ccdbef6b
471eefabc0980475d6623b341a79bc4971b0cd760a87e80b5424eb52048a5432
473f6dfb35695d59f6d67bc6a28f9fcec4a1b7b1f37974543f7923aff9118615
47837a16e7b231cca39151ae124c3cb8ad0fb875a78fb39ef15725f9bd7a8870
47e8953eb8bca1d9b667405d1a6bee9cfc01c334394188d0ac4eabd41ec41b93
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4a492a4579667f5a6ae2d81e7a9aa22222cba42ebe712f60b93eb3698d8c00cb
4a7cc3810e9012a315f69d1dc6a4089e5b1e8db39f1707d3dd4d22c67462bb51
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c216860f82a201e909b917ff2eca53e9787b05ec1fe5a69a0d4b994d95781c5
4c240c4ac6e19ba6374608ca86e43c632814c2666a3d0fbcff7a73303624b414
4ca18c247df52dd22650bd7f72f71d7c98102243b0ec474f683c6a279ad3a668
4d04e98fa76e2cdba4b0b45b0b206b13de39ff72f6371b7d97ed515e21646722
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
4fa898d9bdc34304905c4b165e561c8dc3fe452b0bdd7259140e1aa530a42136
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50629fbe7dd47a2baa94f1b35db2ebf4db8493a978ec9c4832a9318a945bcefe
51b9c4f1aa6c3e60906e6dad687a22e11aa9f5e517d748eafcba598b1a683b30
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
53a0ab3378c2f049263ebcc0c75640e510b79c8f7f11ed06a2f0b044e6639c87
53ec751bb303f77b16e6c949e4e5d3e85664d82205f00981199616f4927bb6e0
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54fbb71b64403c94cb8b42d2ed2db491bb639db63896bc81f12370e535843774
551f890cd0db913ed40a3d0e792eb91af7f8281d91314ed16ad3cb6a5ccb4b61
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
58a07739b05fec4d319e4d5c6b1fa4ac79e2a625e08ab3f303929b77fde5bdf4
59d90c97a6f90abcccd6b7f05747b707726f5149e07630a040cb93f1af7183a2
5ad96953ed9f09eb237595f0947c8a02ebc9b14131cd128fecdfc16bf91297ba
5af7f54e4682da1be1484f658f9b15a84537085a4081cef229704a6d8e4ceb71
5b0e52f0010ddd9cedbd18501653235b15aaf7ae8fcd01f75978940f33b82f80
5b70d8eb19ca32d244e29e759e816c343be893232978532c9d5943f838e60e0b
5b781290317bb5a4471047e20b01508bcc414303e5123391bfee2b5c58ee0703
5c2b76989e49a2bd8c651a35634fd43081b13bde1a6385fb8e36dccc1d0d42d8
5ce0cb7f558c1aca9c6e94c7d85d76db859218132923c039b7ef7b38a29f8dfd
5d7c5d22a81ee3d27800eb5d20b5f160efb6cf98d51dd1f0cca7485442f2c5f4
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
6020e58617f93875554a133f107b287c97dd12c8d8b6c0eb3f46f2d04a722be4
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
627a616d9b01ee3678ceb7b6cf9d425c6016b479f39b5cac5288c3096c7028a2
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
64816ef42196992f1120608cafa36df8e03c81064551abb6f23bc00f69bf6727
65885ed15d66ec94c80565a604d399137b7554aef11c66a7e44ed3aa97ba111c
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
69008835f2aaaefd424c308c3e726d6ad4897186ce73fdce8b612c225e86dd39
6941d870c4bac732a6ed7718c594a73cc27000379eaaf241c9e47d982e44f407
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6cc7914bdafe0f7f59505140771131cbd08dcc02bd5b8d5eb97cae4ef7ec99ed
6cdf5b8d8528713b5a7b3fae738d27e6107afa0cc3a8e691a9d612303f6dfd7a
70fd869f92915eb3c9f85d2d2b5a473ba45239ae463b35267642335337c46f06
72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48
730e5d8dcd90d9cf4691585f963626ab7460d8f1d6e7cffd79e9437311c21ff7
733f34aa5ebc6413c906b024e22edde614d3d471d47a5c93e6ccc283bcba43cd
743fab9929b06e6ea08ee7296b84d0068d27d9fe7552b69f351a3298b968910a
74c0349fc386a4f27375a8f7f98c7867ce1f72ba65b9f040993a2bc8c6229ed0
752cb6627738044d241aea7470759409cd69b5d7d639d298b065ad601f304ca4
75e752bf99299219069a5af90f61408be1ab85af71df9aea097bc70e9075c122
76506e128f2b47b7179f5037bd885a1674455ffeb6b5093cdb4c7eefbf436ce8
781b3e8726a42112cd2192dd9654cf6eaf79525c7780e3c4fd8469125cc99563
7a291479495fbb281655d5e870c6d118dc6b7ed18e8c235aef5974c1e9de4e6c
7a6e593f715545a4262c0d9a90d157b6b18ae0900ca6ddf3c6d568134310fc2f
7a77391b2332418f65e80772100bbc84f32dc73e799f3a8ca802927422024238
7b904860c3bb0a175261eb1073c9a2fa78da35d0e7f4d5146d58ca0c996b9fe7
7bd8b3e8c5d0f5c0a1c5ed3b69c09e4ae5edb40519ad8a1882b007ac3bf91901
7c0597b1b0c771139c958982210f05b275993037f0f3ba20d7a9300a0741dc80
7c46d9a954829d09583e3af58d09df0ab2773f37dc1e3ad593d382c2234fed47
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7c9c80a6c32c0619d61c28f28723e68c5f8f75163e77ee5cf64c39e640e0d71e
7d3e9f675f392ffb980a886b1a7dc458a0c033fa16b48cc12cd51fe6d16ee68b
7dc8c3165af4b63e271bbdf28e2210367805c1dfee8880f4c9c038e16cd57dfd
7e0e8aa8b79a82ed3333ae5ad64bb6ca9c0ab19ecf23bc04e921c26be1f9a9a8
7f5d73c848836745a93ff7aa540a8f83f9899e3668628f42e9ba0cc6ef5e0b32
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
80fcbd06bbf276b74b41aa77405ffd52243587afb254d1efa88027c33fbba932
81f35b682d284eb5c01472a7123abc7b6f57cf0b5a7dcd216b944ceab3ed72d9
820bbf383e1e212ca7bd59f29af6ab490ea9da86e84d61ed3322b9c77ac2fc6c
821262a8c32b52639f97ddf4f34c494e82156651752608fa6a23ffa3df2f84b1
82f60fb22b09313b4ab16333f0d427614b8adb5c74285e988e023aae8d795673
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8352e1640a8e3207cb4f047a7a196b83b84a60010e0331ea8669c18840b2f9c4
839c424b188a9bdafd46e5b643a2c5afb4b7df5e51f0321ffafd5f23b118e259
83ae7ba0370974e803fb70ffffd92deb797d08198ed6310e207ba7d75b72029e
843dea1d022be79c95643821b1140cc2d081094ee77ccf7a1f637a1ad8fca33f
852558e06b451f0305901a729b6f32a4297aee2e85b7c5bdcc0228c346e3a18f
856ed99804bf5b83c5c70314917f7b561f06bfb50cc10ed5430a8fca2c40f246
8685554b355858b7ad6e0bc503213f89d6612b378719637bd032bf3912d1e79f
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
88ec57b8417623a1f1e155f0db4c5a08faf82b19e18cfb8fb27dc17100744360
89d1e5406901d328d618b04cccf1202df32f97bb2831137599bc642ab4b4dfd8
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8b8afd8f60833ca51907899d4a3279cdfd355282858ba8a73cd1034d2a1e31ff
8cefdd6c8f8a7fe4aa027da148a57d33e34988050b4eb05461f4646661dd9504
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f5b3f7177261796d36de2d220664c09162d3877eb2e3868406c27ac952520a1
8f6f381af402557866992339db2b841971e190563a8a69a2c89d8949db511b49
9029197c97f9d383a5544803ea6e353f9b67bbaf6c385a9a8f38a0d1657a275d
91a0770b8a81a169e198ee7d94ffd5e975ca890b1ae75240ae5dae2817a180ca
91bcc65a1a6bb4755e48576889ae27c2f620e49d126b8127dd16c1a99945b9d5
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
931b98e3bdd66e460202a85744656356cad4b1b41ecea51fc0869da7dc77cbae
933ff38629199ba200d23e1a3afda3ca9cae06352169926a4609942ab4d3742b
94fee7717069b4c601d1eda72a12f82cd10354f59b9766a92536983d1b7ab0c1
95112c9137bfbf4201f0da94b6bddc5067ab270455419e5db9fec6d6a061be6b
9652a04e786af562fe276abb568aae827014a1773877100e08eaa305b6ce2e85
986ccecb5ddec6d653cdb03022cbb35af07301b752cad8ac1d6c7aa66a11e661
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9aba16a6f98130875d5393a65f1975708a4a7a55a20edc943b679eabac02bf7b
9de51f3e852115d698f0dbaa4fcb534be995f2f3aafbdbd04165a8ccf5bacf5d
9e1dae23d3ad3212f67d09ca79a50003c32953c36bab976f634c9b38d8a8c6dc
9f24d6f6308f119fdf8fdf6150b6ea48fef956916ab7f22abc1725f7335a7db1
9fb6084a36818c42b3de0291310504e999f18b00fbd3628613c1380c63f7e05d
a033870063ffdcdc1b7842eec37e0e5ab4a66f5d0788eef0bea2f710b1c3c0d5
a0557e5ebe3a2061bb8e557370300a061019d3cea3642a3a08c0267026ffb1e1
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1b053b5e005612a140e8a725c0dcdc5393c15d3c4cc45164fece0f9e8f2cbd4
a208ff8707bb3e24896c1ea292daa9faabc093e8ce9f6363de8b0ef306a52c1e
a41b806e591339f4357460a85a5c04b8f473f1c80ef3a1c3e3e14cf76f4471d4
a48b96eb4dbabdf7d10b4a7667062cd55b7c1f9aab381f05c916798ec4308f68
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4eab6932f42334172b3a48e3c86969f36b63c44420755aa83197c927f439a4e
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a54690656b18f041c597eb704cbc6ee95c571db2ed7460392e7c49b899dcc74f
a63284d0b07236a49f89dd197f9aa2ea595e314e750b5d42834fbda2f7cba411
a695b8b12c7d88355d0b1b33d6c643a7913bcfbeae91553bd7560019188b1032
a7d737341853b8013d3c36a41dda336005b1d6acdde6bf24977f7c4d1b229828
a832c721859e66024092445300431d52b19ce96eb53588ad13954e78be2a8580
a996e7499ac6bccf92e156e87689af5666069dc01bf2b6efd40063f014702c20
a9b8757ef83403b67a3f6d10da0c8f4259179fe48a775020aeb65ab9e1791cc3
ab7ff044ec2e95bca736f374cf86af08c260384fbcf871032bd54e2b4ef509a9
ab8517f3d5171dd42a8b9c22af6a2f944b41d00e7ea54ba02b4ed71a6c59e543
ac888a811086e5e08352c3dc0d0b704206641c37f78b1932c3ca956367aed497
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
ad682af386ad4c5c4ef835159d4fbcfc30638462aa4c5d8cfd6b271da5d91d45
adac5f0ac3cba09025628039e8467b22408fa62d59c8b9c1b5b7f4a412306741
ae7035fc79c92988ad3abf6bbcd7fffb307e0e5c76c140efe0b899bd4380bfb7
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aee4051a20e975b9bb6fdc20984a091eb1f55c35ea87abe441db4cdbe8c116d0
af6aafd437d899bea1c7a01d77830ee97f3e7f30f9e3be515ed8b47df98a6097
af791f4ecfb200dd519a03dc1760721fd4fc36cd3ef9f0b5caf592f9a3d49b91
aff8084000d2c0e029860444700f6c44b5d0124101ae9f87a9bb7d6b574fe24e
b0d0d8d4d905ad8cf5c26b2f074de1b2ad84074a222065a512f51b3298494371
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b18a444786e87c2665b14a39523fa453710642cbc629823d448bc3e88f14219b
b2ac16b228712faf976cdd913df75af40fd04cb4377808ce7f5d9ac091303592
b2acf0f03e69229d991ef09e7d97a16e078ae026dd777a36922a588fe9914dd5
b34b500b4fe4d4f0be72fcb5b7c582c472495b1498072d19a1aaac0dc2022195
b36d838681171ab6906d3206d2fd6cc17a7a7a5867213c7595fe0865aeb9e969
b5d6afdc43eb876b18c0a4ff25f6d2cd305f03a8970e3134e00670b707afa463
b699550edacfe847212b1149dd031f2f48217c87fcc183c2726a6277ad8288ff
b73e577f4d3cebf04fd7a68c6f8f087a41ebd9414f550b6020ba539473e5893d
b8af4f553fff4eaf46702024235228e57a20b045ca2ea9426b4df14aa682a863
ba3ede4e1983d5ed1b23881890a64093ce7d891dadeaf500a943859eb76cc728
ba5a6577ef04a324ae8a4af890e1e26d341ac85bc5c49ad9be1678a61fcc3168
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bc82310d2b82f3aa74a269e8f679359bda827c649adb41486fd1af268a026ac1
bf26f6a32c5ed97a743a72e5fad86c815d423834bbe1e23b9c1410e31b5282df
bf75e6945384ed8e4f8f260cb4953b0b9ad49411c16a4a73b0eed12d2a857fff
bf7da55ef6be4cdd0d0932dd1e689a423b9b04c68e3cc9b083d4c099bf0e0ec9
c07125e852d86e5155db6183d60cf7a4575788766760d5383a70576e1e81535a
c0991b97beead703a6a3ff0d87239036bcdbe2838aea047d27197fb4917d6996
c1a002e1c66e42dfb20cb146829687f9c5f07d76da85a5611307f3f1f67a8199
c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e
c336ddb640bc4214acc849ac9bc3f69f05cecfabb245e18674b46a089ea1313c
c38bc51d1b1c8db7f2037ae18da46d0fb6733d3e7bee635e160eb73f870d5a6e
c3c69d561e2ecc27d9b8ac902008f419f8f0965607d11fb465f292182af8965e
c40d4a64885f7716333758ee5f7c62d2ffdefa767e00456d30501941b88813c5
c45f77ccf825ed595a9da96ff8d103bf9da0290d1e1171a2f196da6291aa449c
c540cdeba4eb897beea1c93c6452269a4de7b86a2e670b5b0ad37f9bbfc78c53
c5993f8467dfbb45dfd3f751abd48089b840da8105caca380d0bc0f8ec387b11
c5f572ed80485a43331f587039ef455ab7400d278434cdee0965a0fea35befcf
c60110236e57f0f952ff51681881465e3652e17baa1b702737c53f57ef5c2bd5
c6038de77c2fca2f75327c1e7ec4751a8d45cc3737395a2abe403ac6d8e98144
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cbccc935557398179deeef044a5ab2353e97ca4961f313793c8ba03964c43e93
cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7
ccebd5a925c1061c439066a3c67e73e36e59c3066e5dfc6230c1f114ee4393ef
cd0b7385c8a691d9b2e7af11f3fbe1e7b1f42ecf11531882594908bf4a1b830e
cdd102d71e33401eb5ebadb19f1732edafa44df8800da6d33f29329c3ed9baef
ce02a171fe79c0155c0e09b826d4e6542ab09be711d05cf4d75d569622a9d24c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d093427c28f9036fa0ce26754e136ea10e19760cd1914e61bf5c92b3d400f06d
d242bba7cc06e3d1b6938664f65ea42f256548886533a4e03281855dbab910b5
d2cf823ebd1e2d7b0649b99673b599eda7de0e6f83e2ef0d09531576709b0ec8
d3110f199d22d9d122a62c288cca3b3c80edccdb2979c02bcbfa0602a7b88039
d31d9df7808e6c73f1d25efb83730a1dcb32f0bd3b7ec132da7cf7bbfd6f5d61
d40c19c83303bfe197a42b9fee896325dc7f81a54decd63441dcb0302055caf4
d563298c3ede28f01a71384931c619cda9aadce1007034f284f3c0f0316303f0
d58ae6ea609795c67de7eea969149b529d8480befb7bd53b7ad20755ec3b4ff1
d623d4148afe3958f8cf929fccf8a2661b93a30e7f0550fd26f478dca78ab492
d666d7eced304e81fefa53e0f5305989a4ac2d9c264787886103643f3e840fa9
d6fbd6d46b0a1be6a3cdc49f712f83d661805a42fc37993340e2cc4493819adc
d72c9fb59846aff6405d2973c81bd8da823493502fab893e026a736a1ba01838
d7f817255acac24d24766a420471f23c0796b5228b84f8432bf70570ed870b72
d8b0939d4ad62069a09916859d301d5a0d9c00e9174ad682c53bc122a35bf80e
d900fce5f1d94651e36b997a118c660e4f2196d2df3cfc9e2dd448330978babd
d9129325eb3414d57b26fab773f2bf928c670dfc81ed80e066f85e12fbb26d14
d9f2778c47db32b56109a39c8c3393b7e213095aa043df32153367708a50dcd0
da87c0b95502e71544771d277a27553b58d068d774841511d45b7f262b17b564
db1be639c6bb1d11edb8c716a629847c3e0f5492de69797d3619b34ddd34e878
dc0da2082ec514b4250ffe29a176826c3aef94d4ca0f887586528add66a99f16
dc64a9158182178303644e2e2db0e0b52d48d655ac751365b64aea64b275f245
dc66711d693eede838cc28b1823501a9dd062c6cbd6c51e7b5bca42c2cc95d9b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd76966336047650cefcf04deb9fa6109be2943b6c5c5fae4ee733238ad6f281
dd86dcaa939981748de2cd61d9016882fc0c9358e3e887cb3701cd2171d8df9a
ddbfe856be75cfeef54986719f4f21277f748a9b7ebb948bfa0ef75332e6b753
dead1f4e72e8cf849bdac46b95a197af4af11ed48877c2db53f38c3b7f43e545
dedd1a2d0818c447fbbdc7f6b52091e5a4f2c8d558d8f8361a59ddfe8561cbdc
df3ac0dbcf2d632d347eedf170353a58fe7d9b6076fea9394ad9858a38b49bd9
e15a095adc9899b592ceccdd4885a3be3674a6bf6ec4be762566360424deb1f3
e17fd2e42b4161652b49ae5e51e37a991e1ec6a10fb893097868bc3e59863bea
e1e394d3e5f917849f224f27fc2a9d52ba89d199b8b3fd3010e8485e1bc42c84
e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b9d318b3157ccbfc3bb00e82a446613294f9a592c01537662386bd848882b7
e42869601ae87a83476b74dbfb615c3acde329931afc04beea4bd387f3703c7e
e561b7eb91282aba0090eb6b74465305f2dbfd9c5ff885d344ec2721fe6f978f
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e803cd8c5031ac6b0d099a2d96ba1c3ee44782649a7f7c6f0d09b6410d93e216
e84418fa9bb7dc9b980511c38088001ebe424a68752b43dafb8812839bd95015
e8a97225f904b851e6ace09e5a8446be3a66378b701e3f9556761092e275d721
e8cb92b60579b9491a0dc1a4aafc9bee18224b80645722171963e75a0577ae4d
e8d943c317239426e4c43d126168a3a67237de9ac0f3a97ef73afec6e5346ad0
e8de6e633e5c2123495bc42259ab59f3be302805b34c9cb72e8ec8f82cdf9ba5
e9032b8e95fc74d9ce9c069e76ffe86cb4046dc6ae863ffa8410cf445e5feaf3
eabc0f4a5b76ceb76d11713e56e77dc230f3672c9df4c43a79089fa69b056033
eae680a0310650963eb8117946e1b91a75a1e2889b547572e2624aba3afbc3eb
eb4db95cf7c97ce22bd98d1b95dfd82204843cc8854cbe0b3b6b93be4fa41a2f
ebe57ea45a2226e928d739f6bdd9bb1d0425134d06a8d88cc0c669cfcb3123e2
ebf4f635a17d10d6eb46ba680b70142419aa3220f228001a036d311a22ee9d2a
ee004e19a65d9657ccfd05c3c15ed2a49fafecb011b8dc60c799da2fc606fdcf
ef13b0253a986d36b9de961b9d657b6735fc409299b451d1e9a1454f66ce2fec
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efb644893def9b62950c8cbc06a519bef65a85abe36999e3be17e4ae5093eb50
f0d0f2235b17a9ecadc8263a94826ce5c05e8c38e766a082cc7f730bf4790ad2
f0ff4ab83bbeaad40a0e6b6a601254f492c04be8f80c99a787f27fb2cddee2be
f3988a8a95c5faec9bb5307667596b220a12d277072950244393b5f33091e2fb
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f42437392991256301d04a743ae9c380aae62faef9a5bb0d4dde967ae9681df9
f4ffaab5463be46cf07cbf3c41f176b6460d69227ff571112bee8b2860a5728d
f63b683b181032b37e4b8a3fe5d001edc0b40a8df47c66b7966e2e7242f0226d
f67c1dae64731f037f0dcd7598af600024c9546bbdeed1c9f7185b027ef65bb4
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f6d8894bccb6968f9c55a23894a63a454f3425a7a4c19251ba01d9e3493084a0
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f8984d530835313b7a668c60bc371514f44716daa6675dbf1d401e36c1ad3153
f8e60fa507399273a3862f6ca5b4daf3df1b225801d641c564a10336e84773e5
f90b7e728b81ac33ca70ffad5f9e7f0eeb9e834a03d79b8e275ddfcfba0c79c1
f9c4ffcfab2c93ba07bd2d4a2dd53a1d23faace457ade18c52c3f4ea67b8ea68
f9d24c71e954513157a412b5339112437e013cf99070b258e445101f16747500
f9e7478a7ceb5f02339cda0af1f0df3c8f3d108b1f9d5323b962017919ae555f
fea3b3935cf17f0cd5d5fbceab048035f7f4fa295398f3ffc1a5b4d0a030e83b
feb0e7f17014201ea9124f23e3f63965411385abf0103fc682595d0674087a0c
ff0240758b9e151bb465c9876e639325aeffc609f19d61f070de6b918636e25b