identity.mgmresurts.com Open in urlscan Pro
66.201.89.68 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://azdeapi.mgmresorts.com/identity/authorization/v1/anonidp/authorize?state=&client_id=anonidp&redirect_uri=https%3A%2F%2F...
Effective URL:
https://identity.mgmresurts.com/?error=invalid_request&state=
Submission: On August 09 via manual (August 9th 2022, 3:44:50 pm UTC) from CA — Scanned from CA

Summary HTTP 55 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 20 IPs in 2 countries across 29 domains to perform 55 HTTP transactions. The main IP is 66.201.89.68, located in United States and belongs to CYBERCON, US. The main domain is identity.mgmresurts.com.
TLS certificate: Issued by R3 on August 1st 2022. Valid for: 3 months.

This is the only time identity.mgmresurts.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	40.83.140.110 40.83.140.110	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	66.201.89.68 66.201.89.68	7393 (CYBERCON) (CYBERCON)
9	13.226.39.53 13.226.39.53	16509 (AMAZON-02) (AMAZON-02)
3	2600:1400:d:5... 2600:1400:d:5a5::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	20.150.35.164 20.150.35.164	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
13	52.20.121.205 52.20.121.205	14618 (AMAZON-AES) (AMAZON-AES)
2	54.230.163.15 54.230.163.15	16509 (AMAZON-02) (AMAZON-02)
1	54.210.230.128 54.210.230.128	14618 (AMAZON-AES) (AMAZON-AES)
6	63.140.36.139 63.140.36.139	16509 (AMAZON-02) (AMAZON-02)
8 8	52.4.86.119 52.4.86.119	14618 (AMAZON-AES) (AMAZON-AES)
1 1	23.208.216.126 23.208.216.126	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1 1	67.202.105.21 67.202.105.21	32748 (STEADFAST) (STEADFAST)
6 12	18.205.184.158 18.205.184.158	14618 (AMAZON-AES) (AMAZON-AES)
9 10	142.250.72.98 142.250.72.98	15169 (GOOGLE) (GOOGLE)
1 1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2 2	35.190.52.204 35.190.52.204	15169 (GOOGLE) (GOOGLE)
2 2	52.55.144.0 52.55.144.0	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2600:1901:0:8... 2600:1901:0:8eee::	15169 (GOOGLE) (GOOGLE)
2 2	13.225.214.24 13.225.214.24	16509 (AMAZON-02) (AMAZON-02)
1 1	204.2.255.224 204.2.255.224	2914 (NTT-LTD-2914) (NTT-LTD-2914)
1 1	18.211.160.120 18.211.160.120	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4998:14:... 2001:4998:14:800::1001	14777 (YAHOO) (YAHOO)
9 10	151.101.194.49 151.101.194.49	54113 (FASTLY) (FASTLY)
1 1	151.101.2.49 151.101.2.49	54113 (FASTLY) (FASTLY)
1	8.43.72.98 8.43.72.98	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	104.18.19.126 104.18.19.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	68.67.179.153 68.67.179.153	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	104.36.115.109 104.36.115.109	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	192.35.249.127 192.35.249.127	11742 (SPOTX-IAD) (SPOTX-IAD)
1	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
55	20

1 40.83.140.110 (San Jose, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

azdeapi.mgmresorts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.201.89.68 (United States)

ASN7393 (CYBERCON, US)
PTR: securec43.ezhostingserver.com

identity.mgmresurts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 13.226.39.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-39-53.ewr53.r.cloudfront.net

ok4static.oktacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1400:d:5a5::1e80 (New York, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 20.150.35.164 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

widgetcontentserverprod.blob.core.windows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 52.20.121.205 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-121-205.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.230.163.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-163-15.ewr53.r.cloudfront.net

login.okta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.210.230.128 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-210-230-128.compute-1.amazonaws.com

mgm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 63.140.36.139 (United States)

ASN16509 (AMAZON-02, US)

smetrics.mgmresorts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.4.86.119 (Ashburn, United States) 8 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-4-86-119.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.208.216.126 (Edison, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-208-216-126.deploy.static.akamaitechnologies.com

su.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.60.146 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.105.21 (United States) 1 redirects

ASN32748 (STEADFAST, US)
PTR: ip21.67-202-105.static.steadfastdns.net

dp2.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 18.205.184.158 (Ashburn, United States) 6 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-205-184-158.compute-1.amazonaws.com

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.72.98 (United States) 9 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s32-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.52.204 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 204.52.190.35.bc.googleusercontent.com

tag.yieldoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.55.144.0 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-55-144-0.compute-1.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:8eee:: (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)

fei.pro-market.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.214.24 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-24.ewr50.r.cloudfront.net

ads.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 204.2.255.224 (Fort Lauderdale, United States) 1 redirects

ASN2914 (NTT-LTD-2914, US)

abp.mxptint.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.211.160.120 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-160-120.compute-1.amazonaws.com

aorta.clickagy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4998:14:800::1001 (United States)

ASN14777 (YAHOO, US)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 151.101.194.49 (United States) 9 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rtd-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.49 (United States) 1 redirects

ASN54113 (FASTLY, US)

rtd.tubemogul.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.43.72.98 (United States)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.19.126 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.179.153 (Secaucus, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.36.115.109 (United States)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.35.249.127 (Ashburn, United States) 1 redirects

ASN11742 (SPOTX-IAD, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	everesttech.net 23 redirects cm.everesttech.net — Cisco Umbrella Rank: 816 pixel.everesttech.net — Cisco Umbrella Rank: 2926 sync-tm.everesttech.net — Cisco Umbrella Rank: 623 rtd-tm.everesttech.net — Cisco Umbrella Rank: 2519	11 KB
14	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 188 mgm.demdex.net — Cisco Umbrella Rank: 15481	17 KB
10	doubleclick.net 9 redirects cm.g.doubleclick.net — Cisco Umbrella Rank: 208	2 KB
9	oktacdn.com ok4static.oktacdn.com — Cisco Umbrella Rank: 14170	580 KB
7	mgmresorts.com 1 redirects azdeapi.mgmresorts.com — Cisco Umbrella Rank: 135376 smetrics.mgmresorts.com — Cisco Umbrella Rank: 92636	1 KB
3	windows.net widgetcontentserverprod.blob.core.windows.net	40 KB
3	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 413	47 KB
2	spotxchange.com 1 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 516	1 KB
2	openx.net 1 redirects us-u.openx.net — Cisco Umbrella Rank: 396	381 B
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 238	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 530	2 KB
2	scorecardresearch.com 2 redirects ads.scorecardresearch.com — Cisco Umbrella Rank: 2359	696 B
2	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1014	1 KB
2	yieldoptimizer.com 2 redirects tag.yieldoptimizer.com — Cisco Umbrella Rank: 4427	973 B
2	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 309	834 B
2	okta.com login.okta.com — Cisco Umbrella Rank: 6368	97 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	576 B
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 869	451 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 326	752 B
1	tubemogul.com 1 redirects rtd.tubemogul.com — Cisco Umbrella Rank: 6552	200 B
1	yahoo.com ads.yahoo.com — Cisco Umbrella Rank: 2334	194 B
1	clickagy.com 1 redirects aorta.clickagy.com — Cisco Umbrella Rank: 1604	430 B
1	mxptint.net 1 redirects abp.mxptint.net — Cisco Umbrella Rank: 17749	675 B
1	pro-market.net 1 redirects fei.pro-market.net — Cisco Umbrella Rank: 2550	306 B
1	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 195	611 B
1	33across.com 1 redirects dp2.33across.com — Cisco Umbrella Rank: 9416	500 B
1	addthis.com 1 redirects su.addthis.com — Cisco Umbrella Rank: 2290	518 B
1	mgmresurts.com identity.mgmresurts.com	4 KB
0	b4lapp.com Failed www.b4lapp.com Failed
55	29

	Domain	Requested by
13	dpm.demdex.net	assets.adobedtm.com identity.mgmresurts.com
12	pixel.everesttech.net	6 redirects
10	cm.g.doubleclick.net	9 redirects
9	sync-tm.everesttech.net	9 redirects
9	ok4static.oktacdn.com	identity.mgmresurts.com ok4static.oktacdn.com
8	cm.everesttech.net	8 redirects
6	smetrics.mgmresorts.com	assets.adobedtm.com
3	widgetcontentserverprod.blob.core.windows.net	identity.mgmresurts.com
3	assets.adobedtm.com	identity.mgmresurts.com assets.adobedtm.com
2	sync.search.spotxchange.com	1 redirects
2	us-u.openx.net	1 redirects
2	ib.adnxs.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	ads.scorecardresearch.com	2 redirects
2	ps.eyeota.net	2 redirects
2	tag.yieldoptimizer.com	2 redirects
2	idsync.rlcdn.com	2 redirects
2	login.okta.com	ok4static.oktacdn.com login.okta.com
1	www.facebook.com
1	image2.pubmatic.com
1	pixel.rubiconproject.com
1	rtd-tm.everesttech.net
1	rtd.tubemogul.com	1 redirects
1	ads.yahoo.com
1	aorta.clickagy.com	1 redirects
1	abp.mxptint.net	1 redirects
1	fei.pro-market.net	1 redirects
1	c.bing.com	1 redirects
1	dp2.33across.com	1 redirects
1	su.addthis.com	1 redirects
1	mgm.demdex.net	assets.adobedtm.com
1	identity.mgmresurts.com
1	azdeapi.mgmresorts.com	1 redirects
0	www.b4lapp.com Failed
55	34

This site contains links to these domains. Also see Links.

Domain
identity.mgmresorts.com

Subject Issuer	Validity	Valid
identity.mgmresurts.com R3	`2022-08-01` - `2022-10-30`	3 months	crt.sh
*.oktacdn.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-22` - `2023-01-22`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
*.blob.core.windows.net Microsoft RSA TLS CA 01	`2022-05-13` - `2023-05-13`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
accounts.okta.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-13` - `2023-07-25`	a year	crt.sh
smetrics.mgmresorts.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-18`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://identity.mgmresurts.com/?error=invalid_request&state=
Frame ID: EFE9AEA75E7C3E8F89FA4470101F5246
Requests: 25 HTTP requests in this frame

Frame: https://login.okta.com/discovery/iframe.html
Frame ID: DE71B2FE70CC5A2B07C96A8175DA03A7
Requests: 2 HTTP requests in this frame

Frame: https://mgm.demdex.net/dest5.html?d_nsid=0
Frame ID: 2ADB383557B746C749A646E4312FED4C
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

MGM - Sign In

Page URL History Show full URLs

https://azdeapi.mgmresorts.com/identity/authorization/v1/anonidp/authorize?state=&client_id=anonidp&redirec... HTTP 302
https://identity.mgmresurts.com/?error=invalid_request&state= Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

55
Requests

47 %
HTTPS

16 %
IPv6

29
Domains

34
Subdomains

20
IPs

2
Countries

795 kB
Transfer

2019 kB
Size

42
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://identity.mgmresorts.com/help/login
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://azdeapi.mgmresorts.com/identity/authorization/v1/anonidp/authorize?state=&client_id=anonidp&redirect_uri=https%3A%2F%2Fidentity.mgmresurts.com&response_type=code&display=page&login_hint=mgm_app_anon_booking&scope=openid+insecure HTTP 302
https://identity.mgmresurts.com/?error=invalid_request&state= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 16

https://cm.everesttech.net/cm/dd?d_uuid=67302856747123536960136080261082072880 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YvKA7QAAAHc6MwNP

Request Chain 22

https://su.addthis.com/red/usync?pid=16&puid=67302856747123536960136080261082072880&url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D420%26dpuuid%3D%7B%7Buid%7D%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=420&dpuuid=62f280ed9c582871

Request Chain 23

https://idsync.rlcdn.com/365868.gif?partner_uid=67302856747123536960136080261082072880 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomNjczMDI4NTY3NDcxMjM1MzY5NjAxMzYwODAyNjEwODIwNzI4ODAQABoNCO2BypcGEgUI6AcQAEIASgA HTTP 307
https://dpm.demdex.net/ibs:dpid=477&dpuuid=f8876343284b6109f52c78b06fee82996d10d99ac1fa16b8a8b4a157102f9ef4b0da87c991749652

Request Chain 25

https://dp2.33across.com/ps/?pid=897&random=774890656 HTTP 302
https://dpm.demdex.net/ibs:dpid=601&dpuuid=211927319907697&random=1660059886

Request Chain 27

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm=&google_sc=&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_tc= HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEJCZhOXT6qolYNa2qJkr00o&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 29

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm=&google_sc=&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_tc= HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESELyYUNeXI6TxZeOtBIyyPaI&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 31

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm=&google_sc=&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_tc= HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D2634060der%253D51%2526seg%253D2634060&google_gid=CAESEPWWYEc4J2YcAyMXqA4Rc4U&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 33

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782 HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2526v%253D11782&google_gid=CAESEGYWwJiNSMI-JIqts-yKsgM&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 34

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggybackCookie%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEGYWwJiNSMI-JIqts-yKsgM&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 35

https://c.bing.com/c.gif?uid=67302856747123536960136080261082072880&Red3=MSAdobe_pd&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=09144160F42268CF05B5509BF508693F

Request Chain 36

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__ HTTP 302
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEGYWwJiNSMI-JIqts-yKsgM&google_cver=1 HTTP 302
https://pixel.everesttech.net/1x1

Request Chain 37

https://tag.yieldoptimizer.com/ps/ps?t=i&p=2233 HTTP 302
https://tag.yieldoptimizer.com/ps/ps?tc=339825739&t=i&p=2233 HTTP 302
https://dpm.demdex.net/ibs:dpid=22069&dpuuid=2027682440243

Request Chain 38

https://ps.eyeota.net/match?bid=6j5b2cv&uid=67302856747123536960136080261082072880&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D HTTP 302
https://ps.eyeota.net/match/bounce/?bid=6j5b2cv&uid=67302856747123536960136080261082072880&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

Request Chain 39

https://fei.pro-market.net/engine?site=141472;size=1x1;mimetype=img;du=67;csync=67302856747123536960136080261082072880 HTTP 302
https://dpm.demdex.net/ibs:dpid=575&dpuuid=-7349541483565199794

Request Chain 40

https://ads.scorecardresearch.com/p?c1=9&c2=6034944&c3=2&cs_xi=67302856747123536960136080261082072880&rn=1660059885616&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D73426%26dpuuid%3D67302856747123536960136080261082072880 HTTP 302
https://ads.scorecardresearch.com/p2?c1=9&c2=6034944&c3=2&cs_xi=67302856747123536960136080261082072880&rn=1660059885616&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D73426%26dpuuid%3D67302856747123536960136080261082072880 HTTP 302
https://dpm.demdex.net/ibs:dpid=73426&dpuuid=67302856747123536960136080261082072880

Request Chain 41

https://abp.mxptint.net/sn.ashx HTTP 302
https://dpm.demdex.net/ibs:dpid=75557&dpuuid=R1B341_F4594EB3_425C29D4&redir=https://abp.mxptint.net/sn.ashx?ak=1

Request Chain 42

https://aorta.clickagy.com/pixel.gif?ch=124&cm=67302856747123536960136080261082072880&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D79908%26dpuuid%3D%7Bvisitor_id%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:cc7af9c12b90d058d68105cfddcc4a9b

Request Chain 43

https://cm.everesttech.net/cm/yh HTTP 302
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=YvKA7QAAAHc6MwNP&sigv=1&esig=1~8e4650283215d5b4309c5c13c6750559bf4e01e1

Request Chain 44

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=782&dpuuid=YvKA7QAAAHc6MwNP

Request Chain 45

https://rtd.tubemogul.com/migrate_et3/ HTTP 302
https://rtd-tm.everesttech.net/migrate_et3/

Request Chain 46

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WXZLQTdRQUFBSGM2TXdOUA==

Request Chain 47

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YvKA7QAAAHc6MwNP&expires=90

Request Chain 48

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YvKA7QAAAHc6MwNP HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YvKA7QAAAHc6MwNP&C=1

Request Chain 49

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=YvKA7QAAAHc6MwNP HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYvKA7QAAAHc6MwNP

Request Chain 50

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YvKA7QAAAHc6MwNP HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YvKA7QAAAHc6MwNP

Request Chain 51

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YvKA7QAAAHc6MwNP

Request Chain 52

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YvKA7QAAAHc6MwNP&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YvKA7QAAAHc6MwNP&img=1&__user_check__=1&sync_id=3319bf31-17fa-11ed-9477-1bf8f1770203

Request Chain 53

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YvKA7QAAAHc6MwNP&t=2592000&o=0

55 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
identity.mgmresurts.com/
Redirect Chain

https://azdeapi.mgmresorts.com/identity/authorization/v1/anonidp/authorize?state=&client_id=anonidp&redirect_uri=https%3A%2F%2Fidentity.mgmresurts.com&response_type=code&display=page&login_hint=mgm...
https://identity.mgmresurts.com/?error=invalid_request&state=

11 KB
4 KB

211ms
44ms

Document
text/html

66.201.89.68
CYBERCON

General

Check archive.org

Show headers Download Go to

Full URL: https://identity.mgmresurts.com/?error=invalid_request&state=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 66.201.89.68 , United States, ASN7393 (CYBERCON, US),
Reverse DNS: securec43.ezhostingserver.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: bbdc5dc236e75e97e563baba32f3553aec6b244019182c359a9543ace4a62d85

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 4284
Content-Type: text/html
Date: Tue, 09 Aug 2022 15:44:42 GMT
ETag: "46a3e4af5acd81:0"
Last-Modified: Tue, 09 Aug 2022 15:35:43 GMT
Server: Microsoft-IIS/8.5
Vary: Accept-Encoding
X-Powered-By: ASP.NET

Redirect headers

Content-Length: 0
Date: Tue, 09 Aug 2022 15:44:44 GMT
Location: https://identity.mgmresurts.com?error=invalid_request&state=
Request-Context: appId=cid-v1:4469a041-c2d9-4f04-945f-61542024df6e

GET
H2 200 okta-sign-in.min.js Show response
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/js/ 1 MB
395 KB 132ms
45ms Script
application/javascript 13.226.39.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/js/okta-sign-in.min.js

Requested by

Host: identity.mgmresurts.com
URL: https://identity.mgmresurts.com/?error=invalid_request&state=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-53.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

17eb4e2c1b9e78c024883990fb58cc88693ff2506038d7b5c7838d5931adff54

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sun, 31 Jul 2022 06:20:19 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 811466
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Wed, 11 Nov 2020 23:14:03 GMT
server: nginx
etag: W/"87241d457d985afea33124ef787f9bbe"
strict-transport-security: max-age=315360000; includeSubDomains
content-type: application/javascript
via: 1.1 b1cccfee199a18a4097165436eb291a8.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
x-amz-cf-pop: EWR53-C2
x-amz-cf-id: LciU3ZtPQWprFgYOHLjeZjlAKjoTjsI_MPOdK0VbhIgdQWEU0tMA-Q==
expires: Mon, 31 Jul 2023 06:20:19 GMT

GET
H2 200 okta-sign-in.min.css
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/ 192 KB
34 KB 115ms
29ms Stylesheet
text/css 13.226.39.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/okta-sign-in.min.css

Requested by

Host: identity.mgmresurts.com
URL: https://identity.mgmresurts.com/?error=invalid_request&state=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-53.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

1881be9edf187bf3e0c89c23e8e3cc9b87e69308b451ca647d195d69a7d16760

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Sat, 06 Aug 2022 01:22:56 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 310909
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Wed, 11 Nov 2020 23:13:54 GMT
server: nginx
etag: W/"e808ca6874a5dc0660aebd64ba2cd49a"
strict-transport-security: max-age=315360000; includeSubDomains
content-type: text/css
via: 1.1 b1cccfee199a18a4097165436eb291a8.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
x-amz-cf-pop: EWR53-C2
x-amz-cf-id: greiQhcIIZtK3HWMvI4f8lpmVzTY8Lv_Nlt4ayTUMp-oIzPp5a7cYA==
expires: Sun, 06 Aug 2023 01:22:56 GMT

GET
H2 200 custom-signin.241e0fb439244dc50c5929c0513a6765.css
ok4static.oktacdn.com/assets/loginpage/css/ 2 KB
1 KB 163ms
77ms Stylesheet
text/css 13.226.39.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok4static.oktacdn.com/assets/loginpage/css/custom-signin.241e0fb439244dc50c5929c0513a6765.css

Requested by

Host: identity.mgmresurts.com
URL: https://identity.mgmresurts.com/?error=invalid_request&state=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-53.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

dcc89f32e3f978bd4c2e313916b6267abd287eea87daec0e5c049150fd9062aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 28 Jul 2022 14:31:22 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 1041203
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Tue, 22 Mar 2022 23:29:39 GMT
server: nginx
etag: W/"241e0fb439244dc50c5929c0513a6765"
strict-transport-security: max-age=315360000; includeSubDomains
content-type: text/css
via: 1.1 b1cccfee199a18a4097165436eb291a8.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
x-amz-cf-pop: EWR53-C2
x-amz-cf-id: NWcPGKrSg0ldBgEbVBWlx1TwyTmh8WmhBWNeUAi4Mc09yKgO9h3l_A==
expires: Fri, 28 Jul 2023 14:31:22 GMT

GET
H2 200 launch-0ea66e1dcf7b.min.js Show response
assets.adobedtm.com/ce7ab6763665/2280f98f6f3f/ 101 KB
33 KB 122ms
36ms Script
application/x-javascript 2600:1400:d:5a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/ce7ab6763665/2280f98f6f3f/launch-0ea66e1dcf7b.min.js
Requested by: Host: identity.mgmresurts.com
URL: https://identity.mgmresurts.com/?error=invalid_request&state=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:5a5::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 8708c972c8edfb805db7a9c5ad3f27d7d6920f4115fe8bc7dbf5910d9d6863f6

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 15:44:45 GMT
content-encoding: gzip
last-modified: Mon, 01 Feb 2021 20:43:39 GMT
server: AkamaiNetStorage
etag: "8af93e3446724d0c314ec0a5e06f995e:1612212219.496733"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://identity.mgmresurts.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 33086
expires: Tue, 09 Aug 2022 16:44:45 GMT

GET
H/1.1 200
OK configs.js Show response
widgetcontentserverprod.blob.core.windows.net/identitywidgetprod/static/configs/ 29 KB
29 KB 458ms
192ms Script
application/x-javascript 20.150.35.164
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://widgetcontentserverprod.blob.core.windows.net/identitywidgetprod/static/configs/configs.js
Requested by: Host: identity.mgmresurts.com
URL: https://identity.mgmresurts.com/?error=invalid_request&state=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.150.35.164 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 67711ee61d36611f1a4ac7604cbccfcc149048479b3a409707c9f1cfd5c2b8b7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 09 Aug 2022 15:44:44 GMT
Last-Modified: Tue, 02 Feb 2021 22:09:13 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: rvtCOfySCkAR/BfmjDoloA==
ETag: "0x8D8C7C72CDAEA80"
Content-Type: application/x-javascript
x-ms-request-id: f8216d8c-701e-005e-5906-ac9cab000000
x-ms-version: 2014-02-14
Accept-Ranges: bytes
Content-Length: 29292
x-ms-lease-state: available

GET
H/1.1 200
OK adobe.js Show response
widgetcontentserverprod.blob.core.windows.net/identitywidgetprod/static/configs/ 10 KB
11 KB 459ms
183ms Script
application/x-javascript 20.150.35.164
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://widgetcontentserverprod.blob.core.windows.net/identitywidgetprod/static/configs/adobe.js
Requested by: Host: identity.mgmresurts.com
URL: https://identity.mgmresurts.com/?error=invalid_request&state=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.150.35.164 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 3686536ace5198c624f7c31f1e567feecacfef0af16ed2377e811a98acd13b25

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 09 Aug 2022 15:44:44 GMT
Last-Modified: Tue, 02 Feb 2021 22:09:13 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5: KwYAmE45SnQUIg5HjQ5isA==
ETag: "0x8D8C7C72CD9B1D0"
Content-Type: application/x-javascript
x-ms-request-id: 0519cd1c-d01e-0071-7b06-ac1d91000000
x-ms-version: 2014-02-14
Accept-Ranges: bytes
Content-Length: 10591
x-ms-lease-state: available

GET log.cfm
www.b4lapp.com/app/ 0
0

GET
H2 200 initLoginPage.pack.47db94d2da847bad7e35886ca1ebf00e.js Show response
ok4static.oktacdn.com/assets/js/mvc/loginpage/ 204 KB
76 KB 19ms
19ms Script
application/javascript 13.226.39.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok4static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.47db94d2da847bad7e35886ca1ebf00e.js

Requested by

Host:
URL: OktaUtil.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-53.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

e9d48b0544e471c5d920c4216172b6f3c3d1fd4599f2de9c323f5d3582587e3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=315360000; includeSubDomains
content-encoding: gzip
etag: W/"47db94d2da847bad7e35886ca1ebf00e"
age: 1788567
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Thu, 02 Jun 2022 20:18:52 GMT
server: nginx
date: Tue, 19 Jul 2022 22:55:18 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 b1cccfee199a18a4097165436eb291a8.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
x-amz-cf-pop: EWR53-C2
x-amz-cf-id: Q5o7YvIzauRoN9G7DnxZ4S1MF7diafxFC8wLMt01lWI3oRvtxAYI_Q==
expires: Wed, 19 Jul 2023 22:55:18 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 6 KB
2 KB 124ms
38ms XHR
application/json 52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.1.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=0ECD6398524DA9AF0A490D44%40AdobeOrg&d_nsid=0&ts=1660059885503

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/ce7ab6763665/2280f98f6f3f/launch-0ea66e1dcf7b.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

8603a8800f9b9d0ff38121252fdbc82dcf0f846270bd5f98d04abd90838eb957

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://identity.mgmresurts.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-va6-1-v038-0e043f491.edge-va6.demdex.com 10 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: iTcnYxhyQTY=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://identity.mgmresurts.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1626
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 33 KB
12 KB 20ms
19ms Script
application/x-javascript 2600:1400:d:5a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/ce7ab6763665/2280f98f6f3f/launch-0ea66e1dcf7b.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:5a5::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 15:44:45 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
etag: "f259ee6445c19c2ce3c64a1b117a4f35:1597270192.577101"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://identity.mgmresurts.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12184
expires: Tue, 09 Aug 2022 16:44:45 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/ 3 KB
2 KB 22ms
22ms Script
application/x-javascript 2600:1400:d:5a5::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbde2f7ca14e540399dcc1f8208860b7b/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/ce7ab6763665/2280f98f6f3f/launch-0ea66e1dcf7b.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:1400:d:5a5::1e80 New York, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 15:44:45 GMT
content-encoding: gzip
last-modified: Wed, 12 Aug 2020 22:09:52 GMT
server: AkamaiNetStorage
etag: "5dedcda2c8a6c3a51fd419d306427010:1597270192.857753"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://identity.mgmresurts.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1594
expires: Tue, 09 Aug 2022 16:44:45 GMT

GET
H/1.1 404
The specified blob does not exist. undefined.css
widgetcontentserverprod.blob.core.windows.net/identitywidgetprod/static/css/ 0
0 77ms
77ms Stylesheet
application/xml 20.150.35.164
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://widgetcontentserverprod.blob.core.windows.net/identitywidgetprod/static/css/undefined.css
Requested by: Host: identity.mgmresurts.com
URL: https://identity.mgmresurts.com/?error=invalid_request&state=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.150.35.164 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

x-ms-request-id: f8216dfe-701e-005e-3f06-ac9cab000000
Date: Tue, 09 Aug 2022 15:44:44 GMT
x-ms-version: 2014-02-14
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-Length: 215
Content-Type: application/xml

GET
H2 200 fs04imr9WzssbZGpR1t5
ok4static.oktacdn.com/fs/bco/1/ 3 KB
4 KB 19ms
18ms Image
image/png 13.226.39.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok4static.oktacdn.com/fs/bco/1/fs04imr9WzssbZGpR1t5

Requested by

Host: identity.mgmresurts.com
URL: https://identity.mgmresurts.com/?error=invalid_request&state=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-53.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

7e57a9f5f539d07b6c54548293ba20e4f13e8009b0bf295015722648d8e5262c

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 03 Aug 2022 09:57:36 GMT
via: 1.1 b1cccfee199a18a4097165436eb291a8.cloudfront.net (CloudFront)
age: 539229
x-cache: Hit from cloudfront
content-length: 3229
last-modified: Thu, 08 Aug 2019 15:14:15 GMT
server: nginx
etag: "dacbe7d0712f4c9e6a6e2d3cb89aa480"
strict-transport-security: max-age=315360000; includeSubDomains
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-pop: EWR53-C2
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: 1qsQAmbhtUOAULU2ZlYJUCbGZGuMwiakC_OBVDHlKlm3yd1ylGdIsg==
expires: Thu, 03 Aug 2023 09:57:36 GMT

GET
H/1.1 200
OK iframe.html Show response
login.okta.com/discovery/ Frame DE71 546 B
986 B 97ms
18ms Document
text/html 54.230.163.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://login.okta.com/discovery/iframe.html
Requested by: Host: ok4static.oktacdn.com
URL: https://ok4static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.47db94d2da847bad7e35886ca1ebf00e.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-15.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c71558cf94e0875c93b552d52dd5974ae4697ba14e5a8d7c3694247a291ca9b8

Request headers

Referer: https://identity.mgmresurts.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Age: 12299
Connection: keep-alive
Content-Length: 546
Content-Type: text/html
Date: Tue, 09 Aug 2022 12:19:47 GMT
ETag: "718a4c5e710186377bad84fea3c1ebec"
Last-Modified: Thu, 13 Jan 2022 19:10:54 GMT
Server: AmazonS3
Via: 1.1 97838e4a7e48c5b1ece191e6f727eb80.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ko5hJTF12NACsF3NUogdOdFjG4BkFmGW4wGXOQquFFhp_addYwOwdQ==
X-Amz-Cf-Pop: EWR53-C3
X-Cache: Hit from cloudfront

GET
H/1.1 200
OK dest5.html Show response
mgm.demdex.net/ Frame 2ADB 7 KB
3 KB 120ms
26ms Document
text/html 54.210.230.128
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://mgm.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/ce7ab6763665/2280f98f6f3f/launch-0ea66e1dcf7b.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.210.230.128 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-210-230-128.compute-1.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://identity.mgmresurts.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-va6-1-v038-08d267d0a.edge-va6.demdex.com 1 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 5iE8vNduTiA=
content-encoding: gzip
date: Tue, 9 Aug 2022 15:44:45 GMT
last-modified: Wed, 3 Aug 2022 11:58:37 GMT
vary: accept-encoding

GET
H2 200 id Show response
smetrics.mgmresorts.com/ 48 B
465 B 294ms
91ms XHR
application/x-javascript 63.140.36.139
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.mgmresorts.com/id?d_visid_ver=5.1.1&d_fieldgroup=A&mcorgid=0ECD6398524DA9AF0A490D44%40AdobeOrg&mid=67029343285050669010108130566067251461&ts=1660059885639

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/ce7ab6763665/2280f98f6f3f/launch-0ea66e1dcf7b.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.139 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

9bbb69838ac8d81df5b9f87df6e61db4e90b4a74243ace0d4abbb9a66255c3d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://identity.mgmresurts.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 09 Aug 2022 15:44:45 GMT
x-content-type-options: nosniff
server: jag
vary: Origin
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://identity.mgmresurts.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YvKA7QAAAHc6MwNP
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=67302856747123536960136080261082072880
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YvKA7QAAAHc6MwNP

42 B
941 B

54ms
54ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YvKA7QAAAHc6MwNP

Requested by

Host: identity.mgmresurts.com
URL: https://identity.mgmresurts.com/?error=invalid_request&state=

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v038-03f58e01d.edge-va6.demdex.com 29 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: ++5wbBq5TcY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YvKA7QAAAHc6MwNP
Date: Tue, 09 Aug 2022 15:44:45 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 checkbox-sign-in-widget.png
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/img/ui/forms/ 3 KB
4 KB 19ms
18ms Image
image/png 13.226.39.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/img/ui/forms/checkbox-sign-in-widget.png

Requested by

Host: ok4static.oktacdn.com
URL: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/okta-sign-in.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-53.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/okta-sign-in.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 03:41:15 GMT
via: 1.1 b1cccfee199a18a4097165436eb291a8.cloudfront.net (CloudFront)
age: 43410
x-cache: Hit from cloudfront
content-length: 3141
last-modified: Wed, 11 Nov 2020 23:13:56 GMT
server: nginx
etag: "7846b2f8c6d0a7ca69fdd3d3c294e92d"
strict-transport-security: max-age=315360000; includeSubDomains
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-pop: EWR53-C2
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: eJivkiPiDs-6G4w8y9wzYe3zlf-DaRN3cF9-DRtsCY9cCvrEpVFC_g==
expires: Wed, 09 Aug 2023 03:41:15 GMT

GET
H2 200 okticon.woff
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/font/ 20 KB
21 KB 76ms
37ms Font
application/font-woff 13.226.39.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/font/okticon.woff

Requested by

Host: ok4static.oktacdn.com
URL: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/okta-sign-in.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-53.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

Referer: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/okta-sign-in.min.css
Origin: https://identity.mgmresurts.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 10:53:45 GMT
via: 1.1 326fd0f07e6ce3b75fa751c6965f21c8.cloudfront.net (CloudFront)
age: 17460
x-cache: Hit from cloudfront
content-length: 20600
last-modified: Wed, 11 Nov 2020 23:13:55 GMT
server: nginx
etag: "db28723126138387cdf40680e6e0fa5d"
strict-transport-security: max-age=315360000; includeSubDomains
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-pop: EWR53-C2
accept-ranges: bytes
content-type: application/font-woff
x-amz-cf-id: kVpUlk18-woQajFupKbx1iEv6SGK8tl7tO127eKNesFAX5_AubiNlA==
expires: Wed, 09 Aug 2023 10:53:45 GMT

GET
H2 200 montserrat-light-webfont.woff
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/font/ 22 KB
22 KB 56ms
20ms Font
application/font-woff 13.226.39.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/font/montserrat-light-webfont.woff

Requested by

Host: ok4static.oktacdn.com
URL: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/okta-sign-in.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-53.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

Referer: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/okta-sign-in.min.css
Origin: https://identity.mgmresurts.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Fri, 05 Aug 2022 11:04:37 GMT
via: 1.1 326fd0f07e6ce3b75fa751c6965f21c8.cloudfront.net (CloudFront)
age: 362408
x-cache: Hit from cloudfront
content-length: 22112
last-modified: Wed, 11 Nov 2020 23:13:55 GMT
server: nginx
etag: "6225f3ca44b83090833064727a09cc95"
strict-transport-security: max-age=315360000; includeSubDomains
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-pop: EWR53-C2
accept-ranges: bytes
content-type: application/font-woff
x-amz-cf-id: bbMLq-W-5nD5zaYtBbJHEdWGCwnar7txP2qH3XK0f6azPBND3Aprew==
expires: Sat, 05 Aug 2023 11:04:37 GMT

GET
H2 200 montserrat-regular-webfont.woff
ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/font/ 21 KB
22 KB 51ms
20ms Font
application/font-woff 13.226.39.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/font/montserrat-regular-webfont.woff

Requested by

Host: ok4static.oktacdn.com
URL: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/okta-sign-in.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.39.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-39-53.ewr53.r.cloudfront.net

Software

nginx /

Resource Hash

1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

Referer: https://ok4static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.2/css/okta-sign-in.min.css
Origin: https://identity.mgmresurts.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 28 Jul 2022 13:14:21 GMT
via: 1.1 326fd0f07e6ce3b75fa751c6965f21c8.cloudfront.net (CloudFront)
age: 1045824
x-cache: Hit from cloudfront
content-length: 21980
last-modified: Wed, 11 Nov 2020 23:13:55 GMT
server: nginx
etag: "8f2822b73b5f9c106c6f2e0db820bcbb"
strict-transport-security: max-age=315360000; includeSubDomains
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-pop: EWR53-C2
accept-ranges: bytes
content-type: application/font-woff
x-amz-cf-id: Z89cl-xq_BqjvrkabCjoQhFIh7EiljewdYdVrSRCZdTrHedvidjpwg==
expires: Fri, 28 Jul 2023 13:14:21 GMT

GET
H/1.1 200
OK discoveryIframe-82e613074a3700abe11a.min.js Show response
login.okta.com/lib/ Frame DE71 96 KB
96 KB 20ms
20ms Script
application/javascript 54.230.163.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://login.okta.com/lib/discoveryIframe-82e613074a3700abe11a.min.js
Requested by: Host: login.okta.com
URL: https://login.okta.com/discovery/iframe.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.230.163.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-230-163-15.ewr53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e899060d294cd2e7db4544c88c031272590fe5f9b72a8334dc42ee1f1868ce6a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://login.okta.com/discovery/iframe.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 06:48:44 GMT
Via: 1.1 97838e4a7e48c5b1ece191e6f727eb80.cloudfront.net (CloudFront)
Last-Modified: Thu, 13 Jan 2022 19:10:55 GMT
Server: AmazonS3
Age: 32162
ETag: "70070512d01d6451663d06e41f3a5913"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
X-Amz-Cf-Pop: EWR53-C3
Content-Length: 97948
X-Amz-Cf-Id: J1arwlcNs2yRPdRHe3mKzI3TiAtbxUVVZHjEv_y_1i6Dx4Oz-d0jOA==

GET
H/1.1

200
OK

ibs:dpid=420&dpuuid=62f280ed9c582871
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://su.addthis.com/red/usync?pid=16&puid=67302856747123536960136080261082072880&url=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D420%26dpuuid%3D%7B%7Buid%7D%7D
https://dpm.demdex.net/ibs:dpid=420&dpuuid=62f280ed9c582871

42 B
940 B

34ms
34ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=420&dpuuid=62f280ed9c582871

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v038-0a3239abd.edge-va6.demdex.com 9 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: aIXl7jDGT1c=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=420&dpuuid=62f280ed9c582871
pragma: no-cache
date: Tue, 09 Aug 2022 15:44:45 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA"

GET
H/1.1

200
OK

ibs:dpid=477&dpuuid=f8876343284b6109f52c78b06fee82996d10d99ac1fa16b8a8b4a157102f9ef4b0da87c991749652
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://idsync.rlcdn.com/365868.gif?partner_uid=67302856747123536960136080261082072880
https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomNjczMDI4NTY3NDcxMjM1MzY5NjAxMzYwODAyNjEwODIwNzI4ODAQABoNCO2BypcGEgUI6AcQAEIASgA
https://dpm.demdex.net/ibs:dpid=477&dpuuid=f8876343284b6109f52c78b06fee82996d10d99ac1fa16b8a8b4a157102f9ef4b0da87c991749652

42 B
940 B

31ms
31ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=477&dpuuid=f8876343284b6109f52c78b06fee82996d10d99ac1fa16b8a8b4a157102f9ef4b0da87c991749652

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v038-0f351cab5.edge-va6.demdex.com 7 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: j/h2lA7jSXc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Tue, 09 Aug 2022 15:44:45 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://dpm.demdex.net/ibs:dpid=477&dpuuid=f8876343284b6109f52c78b06fee82996d10d99ac1fa16b8a8b4a157102f9ef4b0da87c991749652
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 s97684984249833
smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/ 43 B
201 B 91ms
91ms Image
image/gif 63.140.36.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/s97684984249833?AQB=1&ndh=1&pf=1&t=9%2F7%2F2022%2015%3A44%3A45%202%200&mid=67029343285050669010108130566067251461&aamlh=7&ce=UTF-8&pageName=mgmr%3Aokta%3Alogin&g=https%3A%2F%2Fidentity.mgmresurts.com%2F%3Ferror%3Dinvalid_request%26state%3D&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v58=Identity%20Widget&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=0ECD6398524DA9AF0A490D44%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.139 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:45 GMT
x-content-type-options: nosniff
last-modified: Wed, 10 Aug 2022 15:44:45 GMT
server: jag
etag: 3564951459046293504-4619472541272411906
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 08 Aug 2022 15:44:45 GMT

GET
H/1.1

200
OK

ibs:dpid=601&dpuuid=211927319907697&random=1660059886
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://dp2.33across.com/ps/?pid=897&random=774890656
https://dpm.demdex.net/ibs:dpid=601&dpuuid=211927319907697&random=1660059886

42 B
940 B

36ms
35ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=601&dpuuid=211927319907697&random=1660059886

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v038-08a91816e.edge-va6.demdex.com 9 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: zrinGZ7yRb8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:45 GMT
referrer-policy: unsafe-url
server: 33XP001
x-33x-status: 200004000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://dpm.demdex.net/ibs:dpid=601&dpuuid=211927319907697&random=1660059886
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2 200 s96881968448924
smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/ 43 B
190 B 91ms
91ms Image
image/gif 63.140.36.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/s96881968448924?AQB=1&ndh=1&pf=1&t=9%2F7%2F2022%2015%3A44%3A45%202%200&mid=67029343285050669010108130566067251461&aamlh=7&ce=UTF-8&pageName=mgmr%3Aokta%3Alogin&g=https%3A%2F%2Fidentity.mgmresurts.com%2F%3Ferror%3Dinvalid_request%26state%3D&cc=USD&c16=page%3Dmgmr%3Aokta%3Alogin%7Cclickedon%3Dlogin%20initiate&v58=Identity%20Widget&pe=lnk_o&pev2=Identity%20Widget%20Click%20Events&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=0ECD6398524DA9AF0A490D44%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.139 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:46 GMT
x-content-type-options: nosniff
last-modified: Wed, 10 Aug 2022 15:44:46 GMT
server: jag
etag: 3564951460224434176-4619808600988635647
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 08 Aug 2022 15:44:46 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 2ADB
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.everesttech.net%2F1x1%3F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm=&google_sc=&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_tc=
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.everesttech.net%252F1x1%253F&google_gid=CAESEJCZhOXT6qolYNa2qJkr00o&google_cver=1
https://pixel.everesttech.net/1x1

128 B
691 B

26ms
25ms

Image
image/png

18.205.184.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 18.205.184.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-184-158.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 15:44:46 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 09 Aug 2022 15:44:46 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 s93185333221650
smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/ 43 B
120 B 92ms
92ms Image
image/gif 63.140.36.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/s93185333221650?AQB=1&ndh=1&pf=1&t=9%2F7%2F2022%2015%3A44%3A45%202%200&mid=67029343285050669010108130566067251461&aamlh=7&ce=UTF-8&pageName=mgmr%3Aokta%3Alogin&g=https%3A%2F%2Fidentity.mgmresurts.com%2F%3Ferror%3Dinvalid_request%26state%3D&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v29=okta&v58=Identity%20Widget&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=0ECD6398524DA9AF0A490D44%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.139 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:46 GMT
x-content-type-options: nosniff
last-modified: Wed, 10 Aug 2022 15:44:46 GMT
server: jag
etag: 3564951461441208320-4619393017618129217
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 08 Aug 2022 15:44:46 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 2ADB
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537072980%26val%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm=&google_sc=&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%2...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fus-u.openx.net%252Fw%252F1.0%252Fsd%253Fid%253D537072980%2526val%253D__EFGSURFER__.__EFGCK__&google_gid=CAESEL...
https://pixel.everesttech.net/1x1

128 B
796 B

25ms
25ms

Image
image/png

18.205.184.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 18.205.184.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-184-158.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 15:44:46 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 09 Aug 2022 15:44:46 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 s99861000095551
smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/ 43 B
120 B 91ms
90ms Image
image/gif 63.140.36.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/s99861000095551?AQB=1&ndh=1&pf=1&t=9%2F7%2F2022%2015%3A44%3A45%202%200&mid=67029343285050669010108130566067251461&aamlh=7&ce=UTF-8&pageName=mgmr%3Aokta%3Alogin&g=https%3A%2F%2Fidentity.mgmresurts.com%2F%3Ferror%3Dinvalid_request%26state%3D&cc=USD&c16=page%3Dmgmr%3Aokta%3Alogin%7Cclickedon%3Dlogin%20initiate&v58=Identity%20Widget&pe=lnk_o&pev2=Identity%20Widget%20Click%20Events&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=0ECD6398524DA9AF0A490D44%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.139 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:46 GMT
x-content-type-options: nosniff
last-modified: Wed, 10 Aug 2022 15:44:46 GMT
server: jag
etag: 3564951460019535872-4619409078299518182
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 08 Aug 2022 15:44:46 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 2ADB
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fib.adnxs.com%2Fpxj%3Faction%3Dsetuid(%27__EFGSURFER__.__EFGCK__%27)%26bidder%3D51%26seg%3D2634060der%3D51%26seg%3D2634060
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%25...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm=&google_sc=&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fib.adnxs.com%252Fpxj%253Faction%253Dsetuid(%2527__EFGSURFER__.__EFGCK__%2527)%2526bidder%253D51%2526seg%253D26...
https://pixel.everesttech.net/1x1

128 B
796 B

25ms
24ms

Image
image/png

18.205.184.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 18.205.184.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-184-158.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 15:44:46 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 09 Aug 2022 15:44:46 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 s95077708904881
smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/ 43 B
121 B 92ms
92ms Image
image/gif 63.140.36.139
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.mgmresorts.com/b/ss/mgmidentitywidgetprod,mgmmgmglobalprod/1/JS-2.22.0-LBPJ/s95077708904881?AQB=1&ndh=1&pf=1&t=9%2F7%2F2022%2015%3A44%3A45%202%200&mid=67029343285050669010108130566067251461&aamlh=7&ce=UTF-8&pageName=mgmr%3Aokta%3Alogin&g=https%3A%2F%2Fidentity.mgmresurts.com%2F%3Ferror%3Dinvalid_request%26state%3D&cc=USD&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v29=okta&v58=Identity%20Widget&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=0ECD6398524DA9AF0A490D44%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.36.139 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://identity.mgmresurts.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:46 GMT
x-content-type-options: nosniff
last-modified: Wed, 10 Aug 2022 15:44:46 GMT
server: jag
etag: 3564951460474781696-4619783973109549213
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 08 Aug 2022 15:44:46 GMT

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 2ADB
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fexpires%3D30%26nid%3D2181%26put%3D__EFGSURFER__.__EFGCK__%26v%3D11782
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpir...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fpixel.rubiconproject.com%252Ftap.php%253Fexpires%253D30%2526nid%253D2181%2526put%253D__EFGSURFER__.__EFGCK__%2...
https://pixel.everesttech.net/1x1

128 B
691 B

26ms
24ms

Image
image/png

18.205.184.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 18.205.184.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-184-158.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 15:44:46 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 09 Aug 2022 15:44:46 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 2ADB
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%3D%26piggybackCookie%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fv...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fimage2.pubmatic.com%252FAdServer%252FPug%253Fvcode%253Dbz0yJnR5cGU9MSZjb2RlPTI2NjgmdGw9NDMyMDA%253D%2526piggyb...
https://pixel.everesttech.net/1x1

128 B
691 B

24ms
24ms

Image
image/png

18.205.184.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 18.205.184.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-184-158.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 15:44:46 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 09 Aug 2022 15:44:46 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

ibs:dpid=1957&dpuuid=09144160F42268CF05B5509BF508693F
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://c.bing.com/c.gif?uid=67302856747123536960136080261082072880&Red3=MSAdobe_pd&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=09144160F42268CF05B5509BF508693F

42 B
941 B

49ms
49ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1957&dpuuid=09144160F42268CF05B5509BF508693F

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v038-08f61fa8c.edge-va6.demdex.com 24 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: yF4StGrHSdk=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:45 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 10DFD4B0C7664ECAA142842B4EA04C81 Ref B: YTO01EDGE0813 Ref C: 2022-08-09T15:44:46Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://dpm.demdex.net/ibs:dpid=1957&dpuuid=09144160F42268CF05B5509BF508693F
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H/1.1

200
OK

1x1
pixel.everesttech.net/ Frame 2ADB
Redirect Chain

https://pixel.everesttech.net/1/gr?url=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D71%26external_user_id%3D__EFGSURFER__.__EFGCK__
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&google_hm=WXZLQTdRQUFBSGM2TXdOUA&url=/1/gr%3furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id...
https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1/gr%3Furl=https%253A%252F%252Fdsum-sec.casalemedia.com%252Frum%253Fcm_dsp_id%253D71%2526external_user_id%253D__EFGSURFER__.__EFGCK__&google_...
https://pixel.everesttech.net/1x1

128 B
691 B

25ms
24ms

Image
image/png

18.205.184.158
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.everesttech.net/1x1
Protocol: HTTP/1.1
Server: 18.205.184.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-205-184-158.compute-1.amazonaws.com
Software: Apache /
Resource Hash: bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 15:44:46 GMT
Last-Modified: Mon, 19 Jul 2021 07:56:25 GMT
Server: Apache
ETag: "b3b51c-80-5c775461d9c40"
P3P: CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache, no-cache
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 128

Redirect headers

Location: https://pixel.everesttech.net/1x1
Date: Tue, 09 Aug 2022 15:44:46 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

ibs:dpid=22069&dpuuid=2027682440243
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://tag.yieldoptimizer.com/ps/ps?t=i&p=2233
https://tag.yieldoptimizer.com/ps/ps?tc=339825739&t=i&p=2233
https://dpm.demdex.net/ibs:dpid=22069&dpuuid=2027682440243

42 B
940 B

28ms
27ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22069&dpuuid=2027682440243

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v038-018175776.edge-va6.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: K2hR9HeDRGY=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:45 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NON DSP COR TAIo PSAo PSDo HISo OUR BUS UNI INT DEM OTC"
location: https://dpm.demdex.net/ibs:dpid=22069&dpuuid=2027682440243
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://ps.eyeota.net/match?bid=6j5b2cv&uid=67302856747123536960136080261082072880&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D
https://ps.eyeota.net/match/bounce/?bid=6j5b2cv&uid=67302856747123536960136080261082072880&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D
https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

42 B
958 B

26ms
25ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v038-0c8980341.edge-va6.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-Error: 303,104
X-TID: Lua8XrcyRrE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=30064&dpuuid={UUID_6j5b2cv}
Date: Tue, 09 Aug 2022 15:44:47 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H/1.1

200
OK

ibs:dpid=575&dpuuid=-7349541483565199794
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://fei.pro-market.net/engine?site=141472;size=1x1;mimetype=img;du=67;csync=67302856747123536960136080261082072880
https://dpm.demdex.net/ibs:dpid=575&dpuuid=-7349541483565199794

42 B
941 B

61ms
42ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=575&dpuuid=-7349541483565199794

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v038-09787e484.edge-va6.demdex.com 11 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: d/SkXQlvSSo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:46 GMT
via: 1.1 google
server: Apache-Coyote/1.1
access-control-allow-origin: *
anserver: gapp8.us1
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://dpm.demdex.net/ibs:dpid=575&dpuuid=-7349541483565199794
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: clear
content-length: 0
expires: Mon, 1 Jan 1990 0:0:0 GMT

GET
H/1.1

200
OK

ibs:dpid=73426&dpuuid=67302856747123536960136080261082072880
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://ads.scorecardresearch.com/p?c1=9&c2=6034944&c3=2&cs_xi=67302856747123536960136080261082072880&rn=1660059885616&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D73426%26dpuuid%3D673028567471235...
https://ads.scorecardresearch.com/p2?c1=9&c2=6034944&c3=2&cs_xi=67302856747123536960136080261082072880&rn=1660059885616&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D73426%26dpuuid%3D67302856747123...
https://dpm.demdex.net/ibs:dpid=73426&dpuuid=67302856747123536960136080261082072880

42 B
940 B

31ms
31ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=73426&dpuuid=67302856747123536960136080261082072880

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v038-08466b06f.edge-va6.demdex.com 6 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: FtYi1083SKk=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=73426&dpuuid=67302856747123536960136080261082072880
date: Tue, 09 Aug 2022 15:44:47 GMT
via: 1.1 5163ef6f21ebac65d5a58243b15e5dbe.cloudfront.net (CloudFront)
x-amz-cf-pop: EWR50-C1
content-length: 0
x-amz-cf-id: IR2UEjHcJK6-fSQ2Ofh0UtxSap63YN6Fr2hQ0ssdUowftl23Qo6kpw==
x-cache: Miss from cloudfront

GET
H/1.1

200
OK

sn.ashx
dpm.demdex.net/ibs:dpid=75557&dpuuid=R1B341_F4594EB3_425C29D4&redir=https://abp.mxptint.net/ Frame 2ADB
Redirect Chain

https://abp.mxptint.net/sn.ashx
https://dpm.demdex.net/ibs:dpid=75557&dpuuid=R1B341_F4594EB3_425C29D4&redir=https://abp.mxptint.net/sn.ashx?ak=1

42 B
941 B

38ms
38ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=75557&dpuuid=R1B341_F4594EB3_425C29D4&redir=https://abp.mxptint.net/sn.ashx?ak=1

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-2-v038-0f351cab5.edge-va6.demdex.com 14 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: McoQ+zq8S1w=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=75557&dpuuid=R1B341_F4594EB3_425C29D4&redir=https://abp.mxptint.net/sn.ashx?ak=1
Date: Tue, 09 Aug 2022 15:44:46 GMT
Cache-Control: private
P3P: CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE", CP="NON CUR ADM DEVo PSAo PSDo OUR IND UNI COM NAV DEM STA PRE"
Content-Length: 237
Strict-Transport-Security: max-age=-343046687; includeSubDomains
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

ibs:dpid=79908&dpuuid=c:cc7af9c12b90d058d68105cfddcc4a9b
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=124&cm=67302856747123536960136080261082072880&redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D79908%26dpuuid%3D%7Bvisitor_id%7D
https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:cc7af9c12b90d058d68105cfddcc4a9b

42 B
954 B

25ms
25ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:cc7af9c12b90d058d68105cfddcc4a9b

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v038-0f68d5ab8.edge-va6.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-Error: 300
X-TID: z2LjxferSn8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Tue, 09 Aug 2022 15:44:47 GMT
server: Aorta/20220801.70a5aba4
location: https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:cc7af9c12b90d058d68105cfddcc4a9b
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
access-control-allow-origin
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 3cede98335a8
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 2ADB
Redirect Chain

https://cm.everesttech.net/cm/yh
https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=YvKA7QAAAHc6MwNP&sigv=1&esig=1~8e4650283215d5b4309c5c13c6750559bf4e01e1

0
194 B

107ms
33ms

Image
text/plain

2001:4998:14:800::1001
YAHOO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=YvKA7QAAAHc6MwNP&sigv=1&esig=1~8e4650283215d5b4309c5c13c6750559bf4e01e1

Protocol

Server

2001:4998:14:800::1001 , United States, ASN14777 (YAHOO, US),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 15:44:47 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10001117525&eid=YvKA7QAAAHc6MwNP&sigv=1&esig=1~8e4650283215d5b4309c5c13c6750559bf4e01e1
Date: Tue, 09 Aug 2022 15:44:47 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H/1.1

200
OK

ibs:dpid=782&dpuuid=YvKA7QAAAHc6MwNP
dpm.demdex.net/ Frame 2ADB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D782%26dpuuid%3D%24%7BTM_USER_ID%7D
https://dpm.demdex.net/ibs:dpid=782&dpuuid=YvKA7QAAAHc6MwNP

42 B
940 B

34ms
34ms

Image
image/gif

52.20.121.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=782&dpuuid=YvKA7QAAAHc6MwNP

Protocol

HTTP/1.1

Server

52.20.121.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-20-121-205.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v038-08d267d0a.edge-va6.demdex.com 5 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: ftJn3MGjQV4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:47 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1660059888.557167,VS0,VE0
x-served-by: cache-yul12823-YUL
x-cache: HIT
location: https://dpm.demdex.net/ibs:dpid=782&dpuuid=YvKA7QAAAHc6MwNP
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

/
rtd-tm.everesttech.net/migrate_et3/ Frame 2ADB
Redirect Chain

https://rtd.tubemogul.com/migrate_et3/
https://rtd-tm.everesttech.net/migrate_et3/

0
220 B

27ms
26ms

Image
text/plain

151.101.194.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtd-tm.everesttech.net/migrate_et3/
Protocol: H2
Server: 151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:47 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1660059888.659912,VS0,VE15
x-served-by: cache-yul12823-YUL
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:47 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1660059888.649240,VS0,VE0
x-served-by: cache-yul12825-YUL
x-cache: HIT
location: https://rtd-tm.everesttech.net/migrate_et3/
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2ADB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WXZLQTdRQUFBSGM2TXdOUA==

170 B
188 B

38ms
37ms

Image
image/png

142.250.72.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WXZLQTdRQUFBSGM2TXdOUA==

Protocol

Server

142.250.72.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s32-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:47 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1660059888.712276,VS0,VE0
x-served-by: cache-yul12823-YUL
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WXZLQTdRQUFBSGM2TXdOUA==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 2ADB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YvKA7QAAAHc6MwNP&expires=90

42 B
752 B

156ms
26ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YvKA7QAAAHc6MwNP&expires=90
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 42
X-RPHost: bd0f62a3fbacfef6a33ae6abaf6daf37
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:47 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1660059888.813290,VS0,VE0
x-served-by: cache-yul12823-YUL
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YvKA7QAAAHc6MwNP&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2ADB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YvKA7QAAAHc6MwNP
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YvKA7QAAAHc6MwNP&C=1

43 B
943 B

106ms
80ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YvKA7QAAAHc6MwNP&C=1
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 73819d7c5dea3fd2-YYZ
pragma: no-cache
date: Tue, 09 Aug 2022 15:44:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Ymlidyz7ZAnG0o0XDLIQIoPgC4Cm9ciXeWiQXLVEnbu1spio8IEFIi0nSB%2Fsk56xpaLbFoj3l%2F5wwMNtwbO9hI44qp3HMAEVn8Kp43UmOzhzH0im347KjTtOrriX%2Fy%2FCq2MficbiHuMOg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I2ToIB9VmLi3IUOletJ1fF%2BeTFRf4U2wBXbWQQTnx0KUbLZX7viThzJDSabNn5gdCb8tkOJs5l0tWHA3fJiNjGhO7G5%2B6Ro%2BpLx85csCU7a%2Bhh4Fafr5roL%2BnM5qUea3zoAzEYKBI8jNlg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=88&external_user_id=YvKA7QAAAHc6MwNP&C=1
cache-control: no-cache
cf-ray: 73819d7bec09a244-YYZ
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 2ADB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=YvKA7QAAAHc6MwNP
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYvKA7QAAAHc6MwNP

43 B
1 KB

18ms
18ms

Image
image/gif

68.67.179.153
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYvKA7QAAAHc6MwNP

Protocol

HTTP/1.1

Server

68.67.179.153 Secaucus, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 15:44:48 GMT
X-Proxy-Origin: 149.56.153.184; 149.56.153.184; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1424beb0-c406-441a-b75d-dbef70b58658
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 09 Aug 2022 15:44:48 GMT
X-Proxy-Origin: 149.56.153.184; 149.56.153.184; 570.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid: d70969b5-3a8b-461e-9ade-d8cdde8b18cb
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYvKA7QAAAHc6MwNP
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 2ADB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YvKA7QAAAHc6MwNP
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YvKA7QAAAHc6MwNP

43 B
61 B

54ms
41ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YvKA7QAAAHc6MwNP
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YvKA7QAAAHc6MwNP
date: Tue, 09 Aug 2022 15:44:48 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame 2ADB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YvKA7QAAAHc6MwNP

1 B
451 B

81ms
19ms

Image
text/html

104.36.115.109
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YvKA7QAAAHc6MwNP
Protocol: H2
Server: 104.36.115.109 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 03:03:45 GMT
cache-control: no-store, no-cache, private
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:48 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1660059888.217393,VS0,VE0
x-served-by: cache-yul12823-YUL
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YvKA7QAAAHc6MwNP
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 2ADB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YvKA7QAAAHc6MwNP&img=1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YvKA7QAAAHc6MwNP&img=1&__user_check__=1&sync_id=3319bf31-17fa-11ed-9477-1bf8f1770203

43 B
548 B

87ms
87ms

Image
image/gif

192.35.249.127
SPOTX-IAD

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YvKA7QAAAHc6MwNP&img=1&__user_check__=1&sync_id=3319bf31-17fa-11ed-9477-1bf8f1770203
Protocol: HTTP/1.1
Server: 192.35.249.127 Ashburn, United States, ASN11742 (SPOTX-IAD, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Tue, 09 Aug 2022 15:44:48 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 98
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Tue, 09 Aug 2022 15:44:48 GMT
Server: nginx
Location: /partner?adv_id=6409&uid=YvKA7QAAAHc6MwNP&img=1&__user_check__=1&sync_id=3319bf31-17fa-11ed-9477-1bf8f1770203
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 371
Connection: keep-alive
Content-Length: 0

GET
H2

200

b.php
www.facebook.com/fr/ Frame 2ADB
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YvKA7QAAAHc6MwNP&t=2592000&o=0

43 B
576 B

77ms
36ms

Image
image/gif

2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=YvKA7QAAAHc6MwNP&t=2592000&o=0

Protocol

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mgm.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 08:44:48 PDT
content-encoding: br
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-fb-rlafr: 0
pragma: public
x-fb-debug: 3txM7/SATLhNyBeIXfw731ZEf3C+Rgx2rU3Fai73gDYiNYeWVHZxei9mkMnwnunJ/554Te62VuS239yBU3pxOg==
cross-origin-opener-policy: same-origin-allow-popups
strict-transport-security: max-age=15552000; preload
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: image/gif
vary: Accept-Encoding
cache-control: public, max-age=0
priority: u=3,i
expires: Tue, 09 Aug 2022 08:44:48 PDT

Redirect headers

pragma: no-cache
date: Tue, 09 Aug 2022 15:44:48 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1660059888.425909,VS0,VE0
x-served-by: cache-yul12823-YUL
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=YvKA7QAAAHc6MwNP&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.b4lapp.com
URL: https://www.b4lapp.com/app/log.cfm?c=mgmresurts

Verdicts & Comments Add Verdict or Comment

48 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

42 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-20 09:26:51	Name: demdex Value: 67302856747123536960136080261082072880
.mgmresurts.com/	1969-12-31 23:59:59	Name: AMCVS_0ECD6398524DA9AF0A490D44%40AdobeOrg Value: 1
.everesttech.net/	1970-01-20 13:53:15	Name: everest_g_v2 Value: g_surferid~YvKA7QAAAHc6MwNP
.dpm.demdex.net/	1970-01-20 09:26:51	Name: dpm Value: 67302856747123536960136080261082072880
.mgmresurts.com/	1970-01-20 14:43:39	Name: AMCV_0ECD6398524DA9AF0A490D44%40AdobeOrg Value: -637568504%7CMCIDTS%7C19214%7CMCMID%7C67029343285050669010108130566067251461%7CMCAAMLH-1660664685%7C7%7CMCAAMB-1660664685%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1660067085s%7CNONE%7CMCSYNCSOP%7C411-19221%7CMCAID%7CNONE%7CvVersion%7C5.1.1
.mgmresurts.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.rlcdn.com/	1970-01-20 13:53:15	Name: rlas3 Value: Qdk74Re8m7k1uIV1O6ySjJLyAlgC09pLxSTaHymaJGY=
.addthis.com/	1970-01-20 14:29:15	Name: ouid Value: 62f280ed0001290054060c451c90ee95547f769e3b16bdec5bb0
.addthis.com/	1970-01-20 14:29:15	Name: um Value: g.'67302856747123536960136080261082072880'
.addthis.com/	1970-01-20 14:29:15	Name: uid Value: 62f280ed9c582871
.rlcdn.com/	1970-01-20 06:34:03	Name: pxrc Value: CO2BypcGEgUI6AcQABIGCPHrARAA
.33across.com/	1970-01-20 13:53:15	Name: 33x_ps Value: u%3D211927319907697%3As1%3D1660059886091%3Ats%3D1660059886091
.everesttech.net/	1970-01-20 05:52:18	Name: ev_sync_ax Value: 20220809
.doubleclick.net/	1970-01-20 14:43:39	Name: IDE Value: AHWqTUmkNSD7o6U7CqgiwSnsjk73Us2SUvClxQMZVzEwPM3r9Rn_YKv0Je5pCwk7OdM
.everesttech.net/	1969-12-31 23:59:59	Name: everest_session_v2 Value: YvKA7gAABAX3TBEd
.bing.com/	1970-01-20 14:29:15	Name: MUID Value: 09144160F42268CF05B5509BF508693F
.c.bing.com/	1970-01-20 05:17:44	Name: MR Value: 0
.yieldoptimizer.com/	1970-01-20 13:53:15	Name: fbh0 Value: %7B%7D
.yieldoptimizer.com/	1970-01-20 13:53:15	Name: gcma Value: %7B%22t%22%3A0%2C%22o%22%3Afalse%7D
.yieldoptimizer.com/	1970-01-20 13:53:15	Name: rmxc Value: %7B%22t%22%3A0%2C%22e%22%3A%22%22%2C%22i%22%3Afalse%7D
.yieldoptimizer.com/	1970-01-20 13:53:15	Name: cktst Value: 339825739
.yieldoptimizer.com/	1970-01-20 13:53:15	Name: ckid Value: 2027682440243
.yieldoptimizer.com/	1970-01-20 13:53:15	Name: dph Value: %7B%22t%22%3A%5B119247%5D%2C%22dp%22%3A%5B2233%5D%7D
.yieldoptimizer.com/	1970-01-20 13:53:15	Name: ph Value: %7B%22p%22%3A%5B1025%5D%2C%22t%22%3A%5B119247%5D%7D
.eyeota.net/	1970-01-20 13:53:15	Name: mako_uid Value: 1828347a5ac-68e50000010a5f33
.eyeota.net/	1970-01-20 05:07:40	Name: SERVERID Value: 24371~DM
.scorecardresearch.com/	1970-01-20 14:43:39	Name: UID Value: 1A10636e224acbfa384ed601660059887
.mxptint.net/	1970-01-20 14:43:39	Name: mxpim Value: R1B341_F4594EB3_425C29D4.1.0000000000000000000000000000000000000000000000000000000062F280EF
.everesttech.net/	1970-01-20 05:52:18	Name: ev_sync_yh Value: 20220809
.rubiconproject.com/	1970-01-20 13:53:15	Name: khaos Value: L6MCSNDI-O-5P70
.rubiconproject.com/	1970-01-20 13:53:15	Name: audit Value: 1\|VmzCG1m8Bi/UFa16TRd3PsaGOjcV4xvBMgDcwZ45PG/WaDs14xzbSPcmY24d2FHKNSL+PtK4KlaM1KxoLazIt8oW2SgbbjsrEOjxxX8e+bMekgljR5Jdznb2nD5+aS3laWq/NnCy81x/6K+MJaMXAo76/Gy8ewrDCOeqF/Dn4Co=
.casalemedia.com/	1970-01-20 13:53:15	Name: CMID Value: YvKA8ADY6iZ-4-5eDtqhkgAA
.casalemedia.com/	1970-01-20 07:17:15	Name: CMPS Value: 172
.casalemedia.com/	1970-01-20 07:17:15	Name: CMPRO Value: 172
.adnxs.com/	1970-01-20 07:17:15	Name: uuid2 Value: 2152928374998518150
.adnxs.com/	1970-01-20 07:17:15	Name: anj Value: dTM7k!M4.FErk#WF']wIg2ImGL04JW!@wnfH)iR8PMp-v=0GSfl]214iJ%Bil!%va33sKdo2Q=_(j#iP(Md+uBZ.Nkx3I%>2H1Y7<wEexQ67Oe!@F2W*9acz
.casalemedia.com/	1970-01-20 07:17:15	Name: CMTS Value: 036
.openx.net/	1970-01-20 13:53:15	Name: i Value: fd623681-53f3-4b82-96a5-82d895dcc4d9\|1660059888
.pubmatic.com/	1970-01-20 07:17:15	Name: KRTBCOOKIE_218 Value: 4056-YvKA7QAAAHc6MwNP&KRTB&22978-YvKA7QAAAHc6MwNP&KRTB&23194-YvKA7QAAAHc6MwNP&KRTB&23209-YvKA7QAAAHc6MwNP
.pubmatic.com/	1970-01-20 05:50:51	Name: PugT Value: 1660014225
.demdex.net/	1970-01-20 09:26:51	Name: dextp Value: 420-1-1660059885786\|60-1-1660059885887\|601-1-1660059885988\|1083-1-1660059886089\|1085-1-1660059886190\|1086-1-1660059886291\|1087-1-1660059886392\|1088-1-1660059886493\|1957-1-1660059886594\|19913-1-1660059886695\|22069-1-1660059886796\|30064-1-1660059886897\|575-1-1660059886998\|73426-1-1660059887099\|75557-1-1660059887200\|79908-1-1660059887300\|83349-1-1660059887401\|144228-1-1660059887502\|144229-1-1660059887603\|144230-1-1660059887704\|144231-1-1660059887805\|144232-1-1660059887906\|144233-1-1660059888007\|144234-1-1660059888108\|144235-1-1660059888208\|144236-1-1660059888309\|144237-1-1660059888410
.spotxchange.com/	1970-01-20 05:47:59	Name: audience Value: 3319bec2-17fa-11ed-9477-1bf8f1770203

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://identity.mgmresurts.com/?error=invalid_request&state= Message: Access to XMLHttpRequest at 'https://www.b4lapp.com/app/log.cfm?c=mgmresurts' from origin 'https://identity.mgmresurts.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://www.b4lapp.com/app/log.cfm?c=mgmresurts Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://widgetcontentserverprod.blob.core.windows.net/identitywidgetprod/static/css/undefined.css Message: Failed to load resource: the server responded with a status of 404 (The specified blob does not exist.)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abp.mxptint.net
ads.scorecardresearch.com
ads.yahoo.com
aorta.clickagy.com
assets.adobedtm.com
azdeapi.mgmresorts.com
c.bing.com
cm.everesttech.net
cm.g.doubleclick.net
dp2.33across.com
dpm.demdex.net
dsum-sec.casalemedia.com
fei.pro-market.net
ib.adnxs.com
identity.mgmresurts.com
idsync.rlcdn.com
image2.pubmatic.com
login.okta.com
mgm.demdex.net
ok4static.oktacdn.com
pixel.everesttech.net
pixel.rubiconproject.com
ps.eyeota.net
rtd-tm.everesttech.net
rtd.tubemogul.com
smetrics.mgmresorts.com
su.addthis.com
sync-tm.everesttech.net
sync.search.spotxchange.com
tag.yieldoptimizer.com
us-u.openx.net
widgetcontentserverprod.blob.core.windows.net
www.b4lapp.com
www.facebook.com
www.b4lapp.com
104.18.19.126
104.36.115.109
13.225.214.24
13.226.39.53
142.250.72.98
151.101.194.49
151.101.2.49
18.205.184.158
18.211.160.120
192.35.249.127
20.150.35.164
2001:4998:14:800::1001
204.2.255.224
23.208.216.126
2600:1400:d:5a5::1e80
2600:1901:0:8eee::
2620:1ec:c11::200
2a03:2880:f112:182:face:b00c:0:25de
35.190.52.204
35.190.60.146
35.244.159.8
40.83.140.110
52.20.121.205
52.4.86.119
52.55.144.0
54.210.230.128
54.230.163.15
63.140.36.139
66.201.89.68
67.202.105.21
68.67.179.153
8.43.72.98
0486530f1e98818865754a08e1b5442ac5a6a36a6bf6042e3b3338a532e998d2
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
17eb4e2c1b9e78c024883990fb58cc88693ff2506038d7b5c7838d5931adff54
1881be9edf187bf3e0c89c23e8e3cc9b87e69308b451ca647d195d69a7d16760
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
3686536ace5198c624f7c31f1e567feecacfef0af16ed2377e811a98acd13b25
40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
67711ee61d36611f1a4ac7604cbccfcc149048479b3a409707c9f1cfd5c2b8b7
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7e57a9f5f539d07b6c54548293ba20e4f13e8009b0bf295015722648d8e5262c
7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1
8603a8800f9b9d0ff38121252fdbc82dcf0f846270bd5f98d04abd90838eb957
8708c972c8edfb805db7a9c5ad3f27d7d6920f4115fe8bc7dbf5910d9d6863f6
9bbb69838ac8d81df5b9f87df6e61db4e90b4a74243ace0d4abbb9a66255c3d3
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bbdc5dc236e75e97e563baba32f3553aec6b244019182c359a9543ace4a62d85
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c71558cf94e0875c93b552d52dd5974ae4697ba14e5a8d7c3694247a291ca9b8
d6b423c91328eec9c218dd8b21ae1e676987d574e5432411a32806e5dd2bde32
dcc89f32e3f978bd4c2e313916b6267abd287eea87daec0e5c049150fd9062aa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e899060d294cd2e7db4544c88c031272590fe5f9b72a8334dc42ee1f1868ce6a
e9d48b0544e471c5d920c4216172b6f3c3d1fd4599f2de9c323f5d3582587e3d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace

identity.mgmresurts.com Open in urlscan Pro 66.201.89.68 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

55 Requests

47 %HTTPS

16 %IPv6

29 Domains

34 Subdomains

20 IPs

2 Countries

795 kBTransfer

2019 kBSize

42 Cookies

1 Outgoing links

Page URL History

Redirected requests

55 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

identity.mgmresurts.com Open in urlscan Pro
66.201.89.68 Public Scan

Screenshot
Live screenshot

Full Image

55
Requests

47 %
HTTPS

16 %
IPv6

29
Domains

34
Subdomains

20
IPs

2
Countries

795 kB
Transfer

2019 kB
Size

42
Cookies

55 HTTP transactions
0 data transactions