www.ducks.org Open in urlscan Pro
13.35.93.104 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://portalc.criticalimpact.com/go/1/751acfca66d1f47e09e5cb74f1f037a9/25997/095966ead8d12da23947229f28c3afba/63827b8c48e8d4eca64...
Effective URL:
https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email
Submission: On October 02 via manual (October 2nd 2024, 4:30:14 pm UTC) from US — Scanned from US

Summary HTTP 182 Redirects Links 25 Behaviour Indicators

Summary

This website contacted 41 IPs in 2 countries across 30 domains to perform 182 HTTP transactions. The main IP is 13.35.93.104, located in United States and belongs to AMAZON-02, US. The main domain is www.ducks.org. The Cisco Umbrella rank of the primary domain is 535763.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on July 30th 2024. Valid for: 5 months.

This is the only time www.ducks.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.72.91.180 52.72.91.180	14618 (AMAZON-AES) (AMAZON-AES)
52	13.35.93.104 13.35.93.104	16509 (AMAZON-02) (AMAZON-02)
8	142.251.40.168 142.251.40.168	15169 (GOOGLE) (GOOGLE)
4	142.251.35.170 142.251.35.170	15169 (GOOGLE) (GOOGLE)
2	151.101.1.229 151.101.1.229	54113 (FASTLY) (FASTLY)
12	142.251.40.162 142.251.40.162	15169 (GOOGLE) (GOOGLE)
6	104.19.147.8 104.19.147.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	31.13.71.7 31.13.71.7	32934 (FACEBOOK) (FACEBOOK)
3	142.250.80.74 142.250.80.74	15169 (GOOGLE) (GOOGLE)
1	34.117.162.98 34.117.162.98	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	151.101.195.52 151.101.195.52	54113 (FASTLY) (FASTLY)
2	142.251.40.238 142.251.40.238	15169 (GOOGLE) (GOOGLE)
4	142.251.40.227 142.251.40.227	15169 (GOOGLE) (GOOGLE)
3	150.171.27.10 150.171.27.10	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	142.251.40.142 142.251.40.142	15169 (GOOGLE) (GOOGLE)
3	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
1	23.200.3.26 23.200.3.26	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	104.22.14.23 104.22.14.23	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	23.206.172.82 23.206.172.82	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	108.139.33.128 108.139.33.128	16509 (AMAZON-02) (AMAZON-02)
2	35.186.224.24 35.186.224.24	15169 (GOOGLE) (GOOGLE)
3	142.250.80.34 142.250.80.34	15169 (GOOGLE) (GOOGLE)
6	142.250.176.194 142.250.176.194	15169 (GOOGLE) (GOOGLE)
1	18.213.84.67 18.213.84.67	14618 (AMAZON-AES) (AMAZON-AES)
1	216.239.36.181 216.239.36.181	15169 (GOOGLE) (GOOGLE)
1	142.251.111.155 142.251.111.155	15169 (GOOGLE) (GOOGLE)
1	151.101.129.140 151.101.129.140	54113 (FASTLY) (FASTLY)
2 4	142.250.80.70 142.250.80.70	15169 (GOOGLE) (GOOGLE)
2	172.217.165.134 172.217.165.134	15169 (GOOGLE) (GOOGLE)
7	142.250.65.225 142.250.65.225	15169 (GOOGLE) (GOOGLE)
4	142.250.80.68 142.250.80.68	15169 (GOOGLE) (GOOGLE)
3 6	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	31.13.71.36 31.13.71.36	32934 (FACEBOOK) (FACEBOOK)
1	18.190.147.75 18.190.147.75	16509 (AMAZON-02) (AMAZON-02)
1	13.35.93.8 13.35.93.8	16509 (AMAZON-02) (AMAZON-02)
1	18.238.49.74 18.238.49.74	16509 (AMAZON-02) (AMAZON-02)
8	142.250.65.162 142.250.65.162	15169 (GOOGLE) (GOOGLE)
1 2	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
3	104.16.224.232 104.16.224.232	() ()
1	104.17.25.14 104.17.25.14	() ()
6	104.18.5.174 104.18.5.174	() ()
182	41

1 52.72.91.180 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-91-180.compute-1.amazonaws.com

portalc.criticalimpact.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

52 13.35.93.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-104.jfk50.r.cloudfront.net

www.ducks.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.251.40.168 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.35.170 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.1.229 (San Francisco, United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.251.40.162 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s81-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.19.147.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 31.13.71.7 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-lga3.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.80.74 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f10.1e100.net

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.117.162.98 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 98.162.117.34.bc.googleusercontent.com

pixel.byspotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.195.52 (San Francisco, United States)

ASN54113 (FASTLY, US)

share.transistor.fm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.40.238 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f14.1e100.net

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.40.227 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 150.171.27.10 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.40.142 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s80-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.65.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.200.3.26 (Edison, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-3-26.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.22.14.23 (None, )

ASN13335 (CLOUDFLARENET, US)

my.hellobar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 23.206.172.82 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-206-172-82.deploy.static.akamaitechnologies.com

analytics.tiktok.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.139.33.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-139-33-128.jfk50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.224.24 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 24.224.186.35.bc.googleusercontent.com

pixels.spotify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.80.34 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.176.194 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f2.1e100.net

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.213.84.67 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-213-84-67.compute-1.amazonaws.com

unomiproduction-ducks.cloud.jahia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.239.36.181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.111.155 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: bk-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.140 (San Francisco, United States)

ASN54113 (FASTLY, US)

pixel-config.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.80.70 (Plainview, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f6.1e100.net

10231870.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
5083104.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.165.134 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s70-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.65.225 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s73-in-f1.1e100.net

d5db279c1ba4d37ac2ec9a5e42ed6173.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.80.68 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s35-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.107.42.14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.71.36 (Secaucus, United States)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-lga3.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.190.147.75 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-190-147-75.us-east-2.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.93.8 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-8.jfk50.r.cloudfront.net

pagestates-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.49.74 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-49-74.jfk52.r.cloudfront.net

assets-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.65.162 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s71-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.33.220.150 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.16.224.232 (None, )

ASN- ()

ads.adventive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN- ()

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.18.5.174 (None, )

ASN- ()

assets.adventivecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
52	ducks.org www.ducks.org — Cisco Umbrella Rank: 535763	7 MB
28	doubleclick.net 2 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 227 googleads.g.doubleclick.net — Cisco Umbrella Rank: 53 td.doubleclick.net — Cisco Umbrella Rank: 216 stats.g.doubleclick.net — Cisco Umbrella Rank: 152 10231870.fls.doubleclick.net — Cisco Umbrella Rank: 923909 ad.doubleclick.net — Cisco Umbrella Rank: 155 5083104.fls.doubleclick.net	241 KB
15	googlesyndication.com d5db279c1ba4d37ac2ec9a5e42ed6173.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 170 pagead2.googlesyndication.com — Cisco Umbrella Rank: 122	170 KB
9	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2952 tracking.crazyegg.com — Cisco Umbrella Rank: 5026 pagestates-tracking.crazyegg.com — Cisco Umbrella Rank: 5963 assets-tracking.crazyegg.com — Cisco Umbrella Rank: 6025	81 KB
8	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 57	739 KB
7	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 46 maps.googleapis.com — Cisco Umbrella Rank: 465	283 KB
6	adventivecdn.com assets.adventivecdn.com	34 KB
6	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 358 www.linkedin.com — Cisco Umbrella Rank: 694	4 KB
6	tiktok.com analytics.tiktok.com — Cisco Umbrella Rank: 821	138 KB
5	google.com analytics.google.com — Cisco Umbrella Rank: 158 www.google.com — Cisco Umbrella Rank: 3	192 B
4	gstatic.com fonts.gstatic.com	95 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 196	154 KB
3	adventive.com ads.adventive.com	70 KB
3	adsrvr.org 1 redirects js.adsrvr.org — Cisco Umbrella Rank: 1647 insight.adsrvr.org — Cisco Umbrella Rank: 1140 match.adsrvr.org — Cisco Umbrella Rank: 413	6 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 52	22 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 378	15 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 112	4 KB
2	reddit.com pixel-config.reddit.com — Cisco Umbrella Rank: 2277 alb.reddit.com — Cisco Umbrella Rank: 1488	761 B
2	spotify.com pixels.spotify.com — Cisco Umbrella Rank: 3536	270 B
2	hellobar.com my.hellobar.com — Cisco Umbrella Rank: 29601	81 KB
2	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1249	13 KB
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 78
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 341	44 KB
1	cloudflare.com cdnjs.cloudflare.com	4 KB
1	jahia.com unomiproduction-ducks.cloud.jahia.com — Cisco Umbrella Rank: 905158	812 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 906	14 KB
1	transistor.fm share.transistor.fm — Cisco Umbrella Rank: 254364
1	byspotify.com pixel.byspotify.com — Cisco Umbrella Rank: 7762	22 KB
1	criticalimpact.com 1 redirects portalc.criticalimpact.com — Cisco Umbrella Rank: 471804	639 B
0	mdhv.io Failed jelly-v6.mdhv.io Failed
182	30

	Domain	Requested by
52	www.ducks.org	www.ducks.org
12	securepubads.g.doubleclick.net	www.ducks.org securepubads.g.doubleclick.net pagead2.googlesyndication.com
8	pagead2.googlesyndication.com	securepubads.g.doubleclick.net pagead2.googlesyndication.com www.ducks.org
8	www.googletagmanager.com	www.ducks.org www.googletagmanager.com
6	assets.adventivecdn.com	srcdoc
6	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com
6	td.doubleclick.net	www.googletagmanager.com
6	analytics.tiktok.com	www.ducks.org analytics.tiktok.com
6	script.crazyegg.com	www.ducks.org script.crazyegg.com
5	px.ads.linkedin.com	2 redirects www.ducks.org
4	www.google.com	www.ducks.org securepubads.g.doubleclick.net tpc.googlesyndication.com
4	fonts.gstatic.com	fonts.googleapis.com
4	connect.facebook.net	www.ducks.org connect.facebook.net www.googletagmanager.com
4	fonts.googleapis.com	www.ducks.org srcdoc
3	ads.adventive.com	www.ducks.org ads.adventive.com
3	googleads.g.doubleclick.net	www.googletagmanager.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.ducks.org
3	bat.bing.com	www.ducks.org bat.bing.com
3	maps.googleapis.com	www.ducks.org maps.googleapis.com
2	5083104.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	www.facebook.com	www.ducks.org
2	ad.doubleclick.net	www.ducks.org
2	10231870.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	pixels.spotify.com	pixel.byspotify.com
2	my.hellobar.com	www.googletagmanager.com my.hellobar.com
2	www.redditstatic.com	www.googletagmanager.com www.ducks.org
2	www.youtube.com	www.ducks.org
2	cdn.jsdelivr.net	www.ducks.org
1	cdnjs.cloudflare.com	ads.adventive.com
1	match.adsrvr.org	js.adsrvr.org
1	insight.adsrvr.org	1 redirects
1	assets-tracking.crazyegg.com	script.crazyegg.com
1	pagestates-tracking.crazyegg.com	script.crazyegg.com
1	tracking.crazyegg.com	script.crazyegg.com
1	www.linkedin.com	1 redirects
1	d5db279c1ba4d37ac2ec9a5e42ed6173.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
1	alb.reddit.com	www.ducks.org
1	pixel-config.reddit.com	www.ducks.org
1	stats.g.doubleclick.net	www.googletagmanager.com
1	analytics.google.com	www.googletagmanager.com
1	unomiproduction-ducks.cloud.jahia.com	www.ducks.org
1	js.adsrvr.org	www.googletagmanager.com
1	snap.licdn.com	www.ducks.org
1	share.transistor.fm	www.ducks.org
1	pixel.byspotify.com	www.ducks.org
1	portalc.criticalimpact.com	1 redirects
0	jelly-v6.mdhv.io Failed	www.ducks.org
182	47

This site contains links to these domains. Also see Links.

Domain
migrationmap.ducks.org
www.youtube.com
convention.ducks.org
donate.ducks.org
www.wetlandsamericatrust.org
www.duckdna.com
www.duckexpo.com
duckscdn.blob.core.windows.net
give.ducks.org
www.ducks.ca
itunes.apple.com
play.google.com
podcasts.apple.com
open.spotify.com
www.facebook.com
twitter.com
www.instagram.com
www.tiktok.com
www.linkedin.com

Subject Issuer	Validity	Valid
*.ducks.org DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-07-30` - `2025-01-03`	5 months	crt.sh
*.google-analytics.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh
*.g.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
script.crazyegg.com Cloudflare Inc ECC CA-3	`2024-08-02` - `2024-12-31`	5 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-07-11` - `2024-10-09`	3 months	crt.sh
pixel.byspotify.com WR3	`2024-08-19` - `2024-11-17`	3 months	crt.sh
share.transistor.fm Certainly Intermediate R1	`2024-09-14` - `2024-10-14`	a month	crt.sh
*.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.gstatic.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
www.bing.com Microsoft Azure RSA TLS Issuing CA 03	`2024-09-16` - `2025-03-15`	6 months	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-05-23` - `2024-11-18`	6 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
my.hellobar.com WE1	`2024-09-22` - `2024-12-21`	3 months	crt.sh
*.tiktok.com RapidSSL TLS ECC CA G1	`2024-07-15` - `2025-07-15`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2024-04-23` - `2025-05-25`	a year	crt.sh
*.spotify.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-05` - `2025-02-04`	a year	crt.sh
*.doubleclick.net WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.cloud.jahia.com R11	`2024-08-06` - `2024-11-04`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2024-05-30` - `2024-11-26`	6 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2024-09-11` - `2025-03-11`	6 months	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2024-06-30` - `2025-07-30`	a year	crt.sh
tpc.googlesyndication.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
ads.adventive.com WE1	`2024-09-05` - `2024-12-04`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
assets.adventivecdn.com WE1	`2024-09-05` - `2024-12-04`	3 months	crt.sh

This page contains 22 frames:

Primary Page: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email
Frame ID: 51A41CA1817AE50A3D90BB89BB3E9265
Requests: 128 HTTP requests in this frame

Frame: https://share.transistor.fm/e/968fae2e
Frame ID: 4956D48F0238069B5108057D41C01AE0
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/r3kmeAoEEgw?si=HEjoUZNRzCcwDRa3
Frame ID: E23CDADE1B586C957AB52BE19C5AB448
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/0Cc11cFzgSc?si=zy7tqrXkH4No39Tf
Frame ID: B9A0845A94CB444F0A780BA741423463
Requests: 1 HTTP requests in this frame

Frame: https://script.crazyegg.com/pages/data-scripts/0113/4211/site/www.ducks.org.json?t=1
Frame ID: 2BAB62EFFBB5D715D478B1702CC3BDD2
Requests: 5 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/976631994?random=1727886605802&cv=11&fst=1727886605802&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a10z8810428079za201&gcd=13l3l3l3l1l1&dma=0&tag_exp=99312314~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: 3E030D04A49750F8057AF693285EE8DA
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-2X0ECQZQ09&gacid=1482221127.1727886607&gtm=45je4a10v895200442z8810428079za200zb810428079&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101671035~101747727&z=308113939
Frame ID: 029A0FCA59EF5FD534334D2FDE12AB27
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/976631994?random=1727886606738&cv=11&fst=1727886606738&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a10za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config
Frame ID: CCDB0D335BFD08318B278D6D2D7F3D1C
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/rul/1040837785?random=1727886606858&cv=11&fst=1727886606858&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a10z8810428079za201zb810428079&gcd=13l3l3l3l1l1&dma=0&tag_exp=99312313~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1
Frame ID: 4541E88AE52D46C3C8BFB91B96A9E72F
Requests: 1 HTTP requests in this frame

Frame: https://10231870.fls.doubleclick.net/activityi;dc_pre=CMO-xZuP8IgDFUcgdgYdjjofiw;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189890828z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=99312313~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail
Frame ID: 5C000AA305579823BD02F130F980DED4
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189890828z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=99312313~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail
Frame ID: D95F4202015AA67F5139F4E3AC6C77AA
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 8F1F45F90112DFA11EC37B29DC97F54A
Requests: 1 HTTP requests in this frame

Frame: https://d5db279c1ba4d37ac2ec9a5e42ed6173.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 3735B78FFE6F3C7A4E60ED4DA5D0AFCA
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvPtcTfFUkZydeVgRQsCxjtKKadHm1r1FbsKMDwRUh_K8a5YZmlAXOCppyzsG98uzSutIWMkdHLSzGnpLpxAgALkHQZn8z3V8DWFpu88PxQvgNW7XtyBo-xkzEH_ubJ4f0z8ru01EEyCFkksDlB7p3MisYhee6Lc01urUywR-036aL4rDD_eXqJ-OVPouUj-uRax05trzQ-9bvNY08DI5ti2gn4jnuVOO7d50nzN9P22PCZ9IMbThiDmCHliy_4kI29iu6VxEDw7ekYNPDlBXX0C54Wn9iMgFDLAyXmPAIY6aGslspCK-ee_hihSjs8t3ROiU54xR0YqeBSUVVbrIBcSTbWTihzZcJ4BlE4aF7vENZkwIbGp6E&sai=AMfl-YSgJW_6_BY-T0HswyaBI9oeegyfkxeTOL50WvhEvTKj0bmL_UvKill94uGEIqN8qMyKKV4K4kgh6u5MyZoe-gBphd-KmdZ28t0DVj14lMqDfYZDCS7Xt2xw6Es&sig=Cg0ArKJSzDdOPPFHbT8-EAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 3277FC5B84C88742678BB52E8B66F503
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssIXmQCCjUbQbY20cgmnfwCVfTp2s0xXu35Ez82SlVru0NlgHAqNlNNXlrFm8P1w4vEIKHp4S7JGe3vmVuKZ3M2lkqtb3m2rSPBWptE47QhRBH8LvjOX6OJt8MaZSWHmjD2HYJJX8edFZaL99gDDss4hDcsVUvaOWTtLSDLBtvYXpCx4w97f93uR_peWl-IkzXFfQpOX4vqmcmTCnz-SMHFBqWSffAEWPSasSkiAHpJqms9u5An1z67nYiQdebGkflOMyp83EY8-QyAT22JqaRLhsTW06jEvt5SmmURhffcNKV3GDb_BVqMjE5oXv1PfOZ7y217aYaPSmGGpLsQc4PlPIImMVhlsapSX4wSoa8K99GhfogLYu33FNlDiCiu9aPTJpUJzKZWcFXyPYqVJdXizTRaZeaRVg&sai=AMfl-YRah6wsI_puwqP5DHYpFSbSUhLtW2i7zHEkiuvAeD9SUhwuS8c6asDGfW4jYtg12mZgsCWnbSqIuzwWtcaqEhGtzDPWGEDZ12i4_YrhMlizv1fXoibfBl3JStMP&sig=Cg0ArKJSzBOXeQrKTq_FEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: FB50454F6BEB8D79CB34782465BDCF9D
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvt4OVHAI1Y3jKcR121tusX1aHHrCSDLJ7hY-KL5lUnrL49cRXjH2JCnx1CmS2pY73jeoPg_Cb59NuSSi_uyKcC_5jjM3K-jpSl5eyAQcBUSXVKWgkM5H0QJ4oIlmhiT7KHmkJCsgrsPkf2we_Yp79vEaGNyXCOysyCdcXL7LGc_6XO5LswvT7_-ZhRxyWwdXu2G5GLpV_iWZxH7MoK6cjPse0uaQoE0AZkLaYesOeoN1Nqkch24M8uIQfLo4syfGasn8quXM2EvptqHnddh62Yrf2k2NjTJa9XKMlE1LBnLosOhI6fWp6DRxcL34fpq5IiNtsiYtkzeacVd4xbHFjmrDpcJZKqZqQDknykP0-9BBmnTnNUVJ1mt1k&sai=AMfl-YSG23ePoqJC3Qe3YeTygMWsv2GQv5_1VwODYl5pilUVBaXHMJX5qMUznktOXsRuWkb_vgpNzgYiVNpUUyYGRdQ-YbE2R_X2JtaZ1bp_dg4tp7e-_s_MG6187spD&sig=Cg0ArKJSzLmh8Oauy3zOEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 4C0DE7C1665C9CACB935724406D9508A
Requests: 8 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/upb/?adv=7mxs1ri&ref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&upid=ltldgpr&upv=1.1.0&paapi=1
Frame ID: B77538911D24FBB1A199EAD9E36B40CD
Requests: 1 HTTP requests in this frame

Frame: https://5083104.fls.doubleclick.net/activityi;dc_pre=CPz9n5yP8IgDFVgNdgYdmwAOHA;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189022034z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail
Frame ID: 23DC0EEA81A061D2ECA5B3E14FD3D3C8
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189022034z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail
Frame ID: AFFA74E0E4CD3F6A737AEEB6E108C785
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html
Frame ID: B979E8D3A9841573EA2BD9F83AA2E1ED
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 18D9292DBEC3708CA21D3C18D2D67D18
Requests: 1 HTTP requests in this frame

Frame: https://assets.adventivecdn.com/cdn-cgi/image/f=auto,q=90,w=130/514/c55a62f5-7d86-41c8-a1e7-aaad3e4d29a0
Frame ID: A2E856C8881D3B76F847EAA42F2604C2
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Duck Hunting - Waterfowl Migration | Ducks Unlimited

Page URL History Show full URLs

http://portalc.criticalimpact.com/go/1/751acfca66d1f47e09e5cb74f1f037a9/25997/095966ead8d12da23947229f28c3afba... HTTP 307
https://portalc.criticalimpact.com/go/1/751acfca66d1f47e09e5cb74f1f037a9/25997/095966ead8d12da23947229f28c3afba... HTTP 302
https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

182
Requests

96 %
HTTPS

0 %
IPv6

30
Domains

47
Subdomains

41
IPs

2
Countries

9433 kB
Transfer

14733 kB
Size

54
Cookies

25 Outgoing links

These are links going to different origins than the main page.

URL: https://migrationmap.ducks.org/
Title: Migration Map

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCa__m0TOnZ587xHMch0IPdA
Title: DU YouTube

Search URL Search Domain Scan URL

URL: https://convention.ducks.org/
Title: DU Convention Learn more about this year's Convention

Search URL Search Domain Scan URL

URL: https://donate.ducks.org/donateonlinesecure.aspx?promokey=joincamobaselayer&ID=14347&responsecode=CQK0AAAA&or=1
Title: DU Expedition Shirt Join today

Search URL Search Domain Scan URL

URL: https://www.wetlandsamericatrust.org/
Title: Wetlands America Trust

Search URL Search Domain Scan URL

URL: https://www.duckdna.com/
Title: duckDNA

Search URL Search Domain Scan URL

URL: https://www.duckexpo.com/
Title: DU Expo

Search URL Search Domain Scan URL

URL: https://duckscdn.blob.core.windows.net/imagescontainer/landing-pages/aboutDU/2023-2028-du-strategic-plan.pdf
Title: 2023-28 Plan

Search URL Search Domain Scan URL

URL: https://duckscdn.blob.core.windows.net/imagescontainer/media/global/statefactsheets/NationalFactSheet.pdf
Title: Fact Sheet

Search URL Search Domain Scan URL

URL: https://duckscdn.blob.core.windows.net/imagescontainer/landing-pages/aboutDU/du-bylaws.pdf
Title: Bylaws

Search URL Search Domain Scan URL

URL: https://donate.ducks.org/donateOnlineSecure.aspx?promoKey=MemorialHonorGiving
Title: Honor & Memorial Giving

Search URL Search Domain Scan URL

URL: https://donate.ducks.org/yearend/ye2023/donateonlinesecure.aspx?promokey=yearend23&id=13906
Title: Donate Now

Search URL Search Domain Scan URL

URL: https://give.ducks.org/campaign/584940/donate
Title: Give Monthly

Search URL Search Domain Scan URL

URL: http://www.ducks.ca/
Title: www.ducks.ca

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/us/app/id563665674

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=org.ducks.android.du.official

Search URL Search Domain Scan URL

URL: https://podcasts.apple.com/us/podcast/ducks-unlimited-podcast/id1483983112

Search URL Search Domain Scan URL

URL: https://open.spotify.com/show/0YgJh4E6Zdae1zYVifFgPa

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCCynl0EGfexjkayx02tBgiw

Search URL Search Domain Scan URL

URL: https://www.facebook.com/DucksUnlimited

Search URL Search Domain Scan URL

URL: https://twitter.com/DucksUnlimited

Search URL Search Domain Scan URL

URL: https://www.instagram.com/ducksunlimitedinc

Search URL Search Domain Scan URL

URL: https://www.tiktok.com/@ducksunlimitedinc

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/DucksUnlimitedInc

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/ducks-unlimited/jobs/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://portalc.criticalimpact.com/go/1/751acfca66d1f47e09e5cb74f1f037a9/25997/095966ead8d12da23947229f28c3afba/63827b8c48e8d4eca6473c7b9fa19141/25997 HTTP 307
https://portalc.criticalimpact.com/go/1/751acfca66d1f47e09e5cb74f1f037a9/25997/095966ead8d12da23947229f28c3afba/63827b8c48e8d4eca6473c7b9fa19141/25997 HTTP 302
https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 81

https://jelly.mdhv.io/v1/star.gif?pid=VeyTa07IwUHIJHbvty1l6y9yE8BK&src=mh&evt=hi HTTP 307
https://jelly-v6.mdhv.io/v1/starV6.gif?evt=hi&pid=VeyTa07IwUHIJHbvty1l6y9yE8BK&src=mh&tx=59ee2c00-8f66-42b8-86fd-8ec2a27f5492

Request Chain 102

https://10231870.fls.doubleclick.net/activityi;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189890828z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=99312313~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail HTTP 302
https://10231870.fls.doubleclick.net/activityi;dc_pre=CMO-xZuP8IgDFUcgdgYdjjofiw;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189890828z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=99312313~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail

Request Chain 117

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432634&time=1727886607227&li_adsId=8f6f5571-6a0f-41e7-87d7-11e3f34109f8&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432634&time=1727886607227&li_adsId=8f6f5571-6a0f-41e7-87d7-11e3f34109f8&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D432634%26time%3D1727886607227%26li_adsId%3D8f6f5571-6a0f-41e7-87d7-11e3f34109f8%26url%3Dhttps%253A%252F%252Fwww.ducks.org%252Fhunting%253Futm_campaign%253D20241002_newsletter_dunews_dunewsoct%2526utm_source%253DCI%2526utm_medium%253Demail%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432634&time=1727886607227&li_adsId=8f6f5571-6a0f-41e7-87d7-11e3f34109f8&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&cookiesTest=true&liSync=true

Request Chain 159

https://insight.adsrvr.org/track/up?adv=7mxs1ri&ref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&upid=ltldgpr&upv=1.1.0&paapi=1 HTTP 302
https://match.adsrvr.org/track/upb/?adv=7mxs1ri&ref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&upid=ltldgpr&upv=1.1.0&paapi=1

Request Chain 161

https://5083104.fls.doubleclick.net/activityi;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189022034z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail HTTP 302
https://5083104.fls.doubleclick.net/activityi;dc_pre=CPz9n5yP8IgDFVgNdgYdmwAOHA;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189022034z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail

182 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request hunting Show response
www.ducks.org/
Redirect Chain

http://portalc.criticalimpact.com/go/1/751acfca66d1f47e09e5cb74f1f037a9/25997/095966ead8d12da23947229f28c3afba/63827b8c48e8d4eca6473c7b9fa19141/25997
https://portalc.criticalimpact.com/go/1/751acfca66d1f47e09e5cb74f1f037a9/25997/095966ead8d12da23947229f28c3afba/63827b8c48e8d4eca6473c7b9fa19141/25997
https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

127 KB
26 KB

644ms
325ms

Document
text/html

13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

e539f4739d8b9d700e5a1582820fe247453cbc7537fa6e30714ba6a6a51fc9bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cache-control: no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Wed, 02 Oct 2024 16:30:04 GMT
expires: Wed, 09 May 1979 05:30:00 GMT
pragma: no-cache
server: openresty
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-amz-cf-id: Et6phSWaoOLbjmQyPaRIjzqRYv2x0ohGnLffzlcZmJF_yDe6hIPoSg==
x-amz-cf-pop: JFK50-P8
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-resolver-ip: 3.213.234.199
x-xss-protection: 1; mode=block;

Redirect headers

content-length: 0
content-type: text/html;charset=UTF-8
date: Wed, 02 Oct 2024 16:30:03 GMT
location: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email
server: Apache/2.4.57 (codeit)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 218 KB
79 KB 391ms
151ms Script
application/javascript 142.251.40.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10231870

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c4cc92ed03f28de663d36415d35c878c16b366a03a15f2ee06467fd73c3923a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 02 Oct 2024 15:59:53 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80031
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
1 KB 448ms
169ms Stylesheet
text/css 142.251.35.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100..900;1,100..900&display=swap

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.170 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f10.1e100.net

Software

ESF /

Resource Hash

8ed40b4be7a49bbc6382f2b7439e6af9eb3a57b5575576d7c39f7085fbf2e3b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 02 Oct 2024 15:41:18 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
502 B 479ms
200ms Stylesheet
text/css 142.251.35.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Sanchez:ital@0;1&display=swap

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.170 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f10.1e100.net

Software

ESF /

Resource Hash

7018a1ab979e80049d6bb8d223f28e5a65851d9b60f5f193e99527a12392ea06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 02 Oct 2024 15:55:48 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 swiper-bundle.min.css
cdn.jsdelivr.net/npm/swiper@11/ 18 KB
5 KB 242ms
77ms Stylesheet
text/css 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/swiper@11/swiper-bundle.min.css

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8b35c6364fba567362c8d577bc907a05f69de0ed074fc038b821c9392d91c215

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"481b-FIrNb6/WFqmJrbwjO8RMNOzohs4"
age: 13383
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Wed, 02 Oct 2024 16:30:04 GMT
content-type: text/css; charset=utf-8
x-served-by: cache-fra-eddf8230090-FRA, cache-den8280-DEN
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 4470
x-jsd-version: 11.1.14

GET
H2 200 swiper-bundle.min.js Show response
cdn.jsdelivr.net/npm/swiper@11/ 148 KB
39 KB 94ms
58ms Script
application/javascript 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/swiper@11/swiper-bundle.min.js

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

25e8f2a0f5931f8bd019e57488af5e80eff074607822f801465ffe3a8d8a4ff1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"25095-EUNPx8gux2zBtwWTzHbqH/pgsgQ"
age: 2101
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220075-FRA, cache-den8280-DEN
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 39661
x-jsd-version: 11.1.14

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 104 KB
32 KB 419ms
186ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

77f3aa498a684bff60dad01d4db51bdf0bc4a21d52a4ba9eb14d838667ed44da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
etag: 920 / 19998 / m202409260101 / config-hash: 13012574024075510349
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 32661
x-xss-protection: 0
server: cafe

GET
H3 200 4211.js Show response
script.crazyegg.com/pages/scripts/0113/ 7 KB
3 KB 231ms
119ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0113/4211.js
Requested by: Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab3c7f0ed22ca2832a9095b788c3e5885f483f473a5dd5b8b357512df4c5c15a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 16070
cf-polished: origSize=6996
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: text/javascript
last-modified: Wed, 02 Oct 2024 12:02:12 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8cc613342dc45388-DEN
access-control-allow-origin: *
ce-version: 11.5.286
server: cloudflare

GET
H2 200 initJahiaContext.js Show response
www.ducks.org/javascript/ 896 B
1 KB 264ms
261ms Script
text/javascript 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ducks.org/javascript/initJahiaContext.js

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

e0fcb87986908d6bdd7123e108fc1142b80f2c04b19c8c63b2cdfa5035586848

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: W/"896-1726230878000"
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:04 GMT
x-resolver-ip: 18.235.143.165
x-cache: Miss from cloudfront
x-amz-cf-id: gmI_N6SAgkGJ5hwNG0uetwXP9CXLJBJoi0wQAXvXUS8i5pqzU2bdaA==
date: Wed, 02 Oct 2024 16:30:04 GMT
content-type: text/javascript
last-modified: Fri, 13 Sep 2024 12:34:38 GMT
vary: accept-encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 896
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 2d91f13f4530b82b88a5cf164f706358.min.css
www.ducks.org/generated-resources/ 391 KB
65 KB 221ms
219ms Stylesheet
text/css 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ducks.org/generated-resources/2d91f13f4530b82b88a5cf164f706358.min.css

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

22503a60891d5a6fc23323b1a5d0320ebcb163c13ea59f5c17a28edfab0ffa87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
etag: 2d91f13f4530b82b88a5cf164f706358.min.css_399993_1727767918816
age: 46
x-content-type-options: nosniff
expires: Wed, 09 Oct 2024 16:29:18 GMT
x-resolver-ip: 3.233.88.158
x-cache: Hit from cloudfront
x-amz-cf-id: pW1cuJbhou3WW1Veq8nRoJk0TP6-fX9aiNmAy1PwtnuycLOaOeKp-A==
date: Wed, 02 Oct 2024 16:29:18 GMT
content-type: text/css;charset=UTF-8
content-disposition: inline;filename="2d91f13f4530b82b88a5cf164f706358.min.css"
last-modified: Tue, 01 Oct 2024 07:31:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private
content-range: bytes 0-399992/399993
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
accept-ranges: bytes
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 9392dba863c9468a01a6cda6699137f.min.js Show response
www.ducks.org/generated-resources/ 107 KB
108 KB 267ms
265ms Script
text/javascript 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ducks.org/generated-resources/9392dba863c9468a01a6cda6699137f.min.js

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

76829cfe9515fe98cee322829ed00c09a3a2bb6651d1575d809208d5bed94f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: 9392dba863c9468a01a6cda6699137f.min.js_109667_1727769207075
x-content-type-options: nosniff
expires: Wed, 09 Oct 2024 16:30:04 GMT
x-resolver-ip: 18.235.143.165
x-cache: Miss from cloudfront
x-amz-cf-id: J-BcPmcrs1DIPgaw5yzT1ya_IsLLZakSdTHwQgGCMo_EJMJtWNnWIQ==
date: Wed, 02 Oct 2024 16:30:04 GMT
last-modified: Tue, 01 Oct 2024 07:53:27 GMT
content-type: text/javascript;charset=UTF-8
vary: Accept-Encoding
content-disposition: inline;filename="9392dba863c9468a01a6cda6699137f.min.js"
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private
content-range: bytes 0-109666/109667
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 109667
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 CsrfServlet Show response
www.ducks.org/modules/ 8 KB
4 KB 261ms
259ms Script
text/javascript 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ducks.org/modules/CsrfServlet

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

4f81013262bedeb10fe9ecd6d77a80065d7994bf69feba288203dbb42d2533aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: no-cache, no-store
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
expires: Sat, 02 Nov 2024 03:00:04 GMT
x-resolver-ip: 3.213.234.199
x-cache: Miss from cloudfront
x-amz-cf-id: gPP16maSoAgd7ayZsWAhJAXogz5QeYenEAdhEMxLVZV3lfQaGGUmQQ==
date: Wed, 02 Oct 2024 16:30:04 GMT
x-xss-protection: 1; mode=block;
content-type: text/javascript;charset=utf-8
vary: accept-encoding
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 icon-location.svg
www.ducks.org/modules/du-templates/images/ui/ 1 KB
1 KB 330ms
328ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/icon-location.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

9c0c9871e17c01315738923db55b38c3437fc294f271f6c48de5e422034b2d03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:04 GMT
x-resolver-ip: 3.213.234.199
x-cache: RefreshHit from cloudfront
x-amz-cf-id: ceH0SRUWQLD-Mrk_YdGeXKfn3PyYHwStSiLIhu8faHirk3WQtoJmzQ==
date: Wed, 02 Oct 2024 16:30:04 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 250x192_camobaselayer_dropdowns_oct24.jpg
www.ducks.org/files/live/sites/ducksorg/files/products/ 20 KB
21 KB 166ms
165ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/products/250x192_camobaselayer_dropdowns_oct24.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

bd1ea1d3fc1088cf080e567465b3b3b4ca6fc288634136908011b275dcf2469a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "db762dd7-e5b4-4b0d-b89a-1c22819959ce-1727385154205"
age: 36
x-content-type-options: nosniff
x-resolver-ip: 3.233.88.158
x-cache: Hit from cloudfront
x-amz-cf-id: CBkO5sazpkwkT_ohzYJfmLBmBXu5yWpH3FF0woj3X-zH-JUy4g0iDA==
date: Wed, 02 Oct 2024 16:29:33 GMT
content-type: image/jpeg
last-modified: Thu, 26 Sep 2024 21:12:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 20952
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 278ms
134ms Script
application/x-javascript 31.13.71.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-lga3.fbcdn.net

Software

Resource Hash

0f25d74b2b7cc729ceeb20792e1059415c4f2a69505def2d73e11b07db77061d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.ducks.org
Referer: https://www.ducks.org/

Response headers

content-md5: V5y+4EMSwxWMk91BzGkPFQ==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "6458e5d227d35ba52e7a66d183fd0a6f"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:38:33 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=1200s
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 8742bf1838f1dbde727d8444de4ac6b4
cache-control: public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality: GOOD; q=0.7, rtt=132, rtx=0, c=24, mss=1232, tbw=8203, tp=13, tpl=0, uplat=0, ullat=-1
x-fb-debug: Hb3UAgkbOWRXkbznbjnzAsdBJtkulAo6V2Kr8WlNW8ofCIfcGK7CmF5loiYim9q2u9JON2OUAH9r6fIF+z62kw==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 1687
origin-agent-cluster: ?0

GET
H2 200 logos_row.png
www.ducks.org/files/live/sites/ducksorg/files/Hunting/WF360/ 60 KB
60 KB 343ms
308ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/WF360/logos_row.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

d4498e20961b5d8f83de4b64281cb8af3d47c4e34947917b1f7f39c040d81808

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "7d4d0940-9969-49ff-9be3-73eebf8e2ddc-1725633930295"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.213.234.199
x-cache: RefreshHit from cloudfront
content-length: 61138
x-amz-cf-id: fM8AhMATwBi-0YF_w6s1etVrTvgK37oMxL5bSbnL5u1_PxLsgc_l3A==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/png
last-modified: Fri, 06 Sep 2024 14:45:30 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 logos_stacked.png
www.ducks.org/files/live/sites/ducksorg/files/Hunting/WF360/ 45 KB
45 KB 512ms
477ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/WF360/logos_stacked.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

03aac47c748e748a6a29a66040d8759abf375223b7b2e90431cc4f07b9c238be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "206d1fc5-9df7-440f-a158-4b0aea488234-1725634195183"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
content-length: 45787
x-amz-cf-id: wSIhUhpHzajc62rQvUF1KEMIM_NSnBNX0a-eI0oL1l2WY0az6ezYnw==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/png
last-modified: Fri, 06 Sep 2024 14:49:55 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 chevron-right.svg
www.ducks.org/modules/du-base-components/images/ 249 B
725 B 190ms
155ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-base-components/images/chevron-right.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

93bcd9640f3bb6636f0984e349c1b5f8c39652da8e7dad4a790142a2c2b376ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
age: 42
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 02:59:23 GMT
x-resolver-ip: 3.233.88.158
x-cache: Hit from cloudfront
x-amz-cf-id: q4sN8f9UopGWVoGsgZMygLghlU-nTxL5OWFiOK0izPrS8Va3iYAGAA==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 17:14:39 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 shutterstock_206349148%201-1.png
www.ducks.org/files/live/sites/ducksorg/files/components/hunting/tool-links/ 89 KB
89 KB 507ms
473ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/components/hunting/tool-links/shutterstock_206349148%201-1.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

007c8eff670dc52481eeeb1b8fa5178b93c858fdb4b41a992bec57efc47c854a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "281b79ed-a976-40bf-b937-ff0f99ef402f-1723585542200"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
content-length: 90775
x-amz-cf-id: -ThDG_8mcyouec6-at9VMHxeOjbm-FaSipr-e2zzLdpitFYSZMuv2A==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/png
last-modified: Tue, 13 Aug 2024 21:45:42 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 duck-numbers-banner.jpg
www.ducks.org/files/live/sites/ducksorg/files/generic-backgrounds/ 128 KB
129 KB 355ms
321ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/generic-backgrounds/duck-numbers-banner.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

cee4bc15154afecee3b80d7ca28822e7de1df64822563aeb4bc122dc6c2ff05c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "52ad80ee-0b14-4c7c-addd-afbe0169ed61-1723665682372"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 18.213.84.67
x-cache: RefreshHit from cloudfront
content-length: 131072
x-amz-cf-id: ME9nO3KEenPKjsZna8ZCT5JH9qqi7INtKDGhVACDQ5HIrk6d88SrAg==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Wed, 14 Aug 2024 20:01:22 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Card-Hunting%20Tips-MO.jpg
www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/Mossy%20Oak%20Images/ 396 KB
396 KB 224ms
192ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/Mossy%20Oak%20Images/Card-Hunting%20Tips-MO.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

ba88a5687c96121ee1d1379c7dbbebf730ef4a88c33a6a108e794c096682c80a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "44315041-c85f-4588-85d5-a48d93ad528d-1723588196335"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 18.213.84.67
x-cache: RefreshHit from cloudfront
content-length: 405041
x-amz-cf-id: 2k9KZJIDbwoOD2Egt5QNT0EFMkbnU6aYQRSevkoW_CkeaCIJCvLamA==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Tue, 13 Aug 2024 22:29:56 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 shutterstock_206349148%201.png
www.ducks.org/files/live/sites/ducksorg/files/components/hunting/tool-links/ 113 KB
114 KB 369ms
337ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/components/hunting/tool-links/shutterstock_206349148%201.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

3f81536b077ab6f27380889b29eaa515bcc10242b7d2edced702705e5479e0b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "5074fc25-f44f-40d1-8138-7b805341ef1e-1723585582005"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 18.213.84.67
x-cache: RefreshHit from cloudfront
content-length: 116037
x-amz-cf-id: M9rhW7UqKIncibeJYp3OH96wXgwIMT6j2x1a33XPC5QpxrwLfjipIQ==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/png
last-modified: Tue, 13 Aug 2024 21:46:22 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Card-Retriever-Training.png
www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/ 60 KB
60 KB 207ms
176ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/Card-Retriever-Training.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

64b2b6f334780e21e14f6b0f4d02052a496c85ab5331389aed8bf19536d59940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "b6128866-8a2b-46ca-8d9c-7e7b6301b0f1-1723587908680"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
content-length: 61145
x-amz-cf-id: NHNlMXt_m5o_AJURwRnrUCkcgdxIjG3IJcEIQ_2aewhV45LRyjLt2A==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Tue, 13 Aug 2024 22:25:08 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Card-Waterfowl-Recipes.png
www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/ 289 KB
290 KB 509ms
478ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/Card-Waterfowl-Recipes.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

4aab11207564611fc1258f396eac9bc804fc33bfd1f7993715c6e747015b1bf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "a824ac54-24b5-42ae-a5c7-677e6f51db89-1723588014731"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
content-length: 296280
x-amz-cf-id: 3QSznO_lN8h1EzLdl5qcJBa_-Qkh3_YDuMcJUmgAGCNbV_V6Zj5dwg==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Tue, 13 Aug 2024 22:26:54 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Card-Decoy-Strategy.png
www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/ 211 KB
212 KB 380ms
350ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/Card-Decoy-Strategy.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

135feed90c43c79f7701f0a565f6b84a6adb15a1f63b349db07644e96e35ef81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "6d4aa968-e295-4a6d-ac3c-f7b4103b17f6-1723588461178"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.213.234.199
x-cache: RefreshHit from cloudfront
content-length: 216349
x-amz-cf-id: Dsua2E0MO4OD8GPk_nJr9IEg--jYLFoTB87AuVIdgkMah5HSt9jb9w==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/png
last-modified: Tue, 13 Aug 2024 22:34:21 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Card-Retriever%20Training-MO.jpg
www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/Mossy%20Oak%20Images/ 164 KB
164 KB 505ms
475ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/Mossy%20Oak%20Images/Card-Retriever%20Training-MO.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

1a595a08f7cef40802cf52fb6b60bdcf76f25bb8e2a1a5eef70d407a8aa9ab99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "e078e739-8161-48f2-b8ea-592e287b0206-1723588554684"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 18.213.84.67
x-cache: RefreshHit from cloudfront
content-length: 167523
x-amz-cf-id: VgkXsB9iux5-6ZIvgZTZiT6L5wkrapJ17KWT_TPW99cKt11yV1pOBw==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Tue, 13 Aug 2024 22:35:54 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Card-Shooting-Tips.png
www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/ 195 KB
196 KB 518ms
488ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/Card-Shooting-Tips.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

0c762bf714cf49ea12994c7a4e0ec0440f8524393c52f8468dd9c036371ca8ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "995347d9-f617-493f-98ba-b7344dcca7b6-1723588632861"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
content-length: 199729
x-amz-cf-id: Qcyj30MclRVVn2ac_2DMWYAyo2M6s1ZnMFVPGS_p6oRL5rBQ5FdDeA==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Tue, 13 Aug 2024 22:37:12 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Card-Gear.png
www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/ 1 MB
1 MB 507ms
478ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/components/hunting/link-grid/Card-Gear.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

d528947118524888924811ebee604ffb04e2e3c977d0250cbbcfabd05916a76e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "b1d559be-db37-4679-9e82-228735c29704-1723587807127"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 18.213.84.67
x-cache: RefreshHit from cloudfront
content-length: 1496139
x-amz-cf-id: m8JxSNS5oxqUj6wGOHfLmsRiV-3SbmhpVknrpGZQHJ05Uc4qGHVRsA==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Tue, 13 Aug 2024 22:23:27 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Hero-DHStories-Konway
www.ducks.org/files/live/sites/ducksorg/files/Hunting/Hunting%20Sections%20Heros/ 179 KB
180 KB 506ms
476ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/Hunting%20Sections%20Heros/Hero-DHStories-Konway

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

572c0e251ccc16eae904bceefc001375fcd80fa6bb58ddbf6857e0fc6417578f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1
etag: "a963da62-33f1-40cb-910d-eabb515dcdc3-1723665607832"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.213.234.199
x-cache: Miss from cloudfront
content-length: 183685
x-amz-cf-id: 7bAsStig1Us9B3DMNgunBXOrG4Ly0ewWzY7zdhwc4qTKjEfAcYPW5g==
date: Wed, 02 Oct 2024 16:30:05 GMT
x-xss-protection: 1; mode=block;
content-type: image/jpeg
last-modified: Wed, 14 Aug 2024 20:00:07 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Johnn%20Hoffman_Decoy%20Lead.jpg
www.ducks.org/files/live/sites/ducksorg/files/Hunting/Decoys/The-Ultimate-Decoy-Spread/ 314 KB
315 KB 518ms
489ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/Decoys/The-Ultimate-Decoy-Spread/Johnn%20Hoffman_Decoy%20Lead.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

9ab9e236fbed276d745c77da046d82876ec7101f0f3810e3ee7cd303bceaccde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "8ebcdeb9-0f83-4295-aed6-d80733903693-1726178009317"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 18.213.84.67
x-cache: RefreshHit from cloudfront
content-length: 321511
x-amz-cf-id: 6XBmzOqNhcWlgOZbaaU2pttkhCLLm4SIYXoEh85_y_PJfrCvRKHCWg==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Thu, 12 Sep 2024 21:53:29 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Teal%20Gear%20Lead.jpeg
www.ducks.org/files/live/sites/ducksorg/files/Hunting/Hunting%20Gear/2024EarlyTealGear/ 514 KB
515 KB 500ms
472ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/Hunting%20Gear/2024EarlyTealGear/Teal%20Gear%20Lead.jpeg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

e87a029e8288a4324fa42c92fe3a2a7ade0f3106bd9573d66fce4eeead58ea00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "87d0a672-c928-4b4e-b8b8-580eb700b253-1726610350280"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
content-length: 526520
x-amz-cf-id: pPmZV5VBCBnVzSKnB2H6naPBB-R7Uqnc0uLZcad1QlQlQh1kG_sThA==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Tue, 17 Sep 2024 21:59:10 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 DougSteinke.com_OpeningDay.jpg
www.ducks.org/files/live/sites/ducksorg/files/Hunting/Hunting%20Tips/Five-Opening-Day-Secrets/ 219 KB
220 KB 404ms
376ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/Hunting%20Tips/Five-Opening-Day-Secrets/DougSteinke.com_OpeningDay.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

22ae6634834b5f8f875b93ab9ae03c44f58ee5327ab4fe4d2353a4aafc6aa62e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "72b160f3-f270-479b-bbfa-e06d0a3b6527-1725659891601"
age: 28
x-content-type-options: nosniff
x-resolver-ip: 3.233.88.158
x-cache: Hit from cloudfront
x-amz-cf-id: OhxwdHz5YKw04ME6dpTVZpWC_VvND-ZnWXkGopujWOObo-YIOsOmHg==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Fri, 06 Sep 2024 21:58:11 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 224153
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 icon-copy.svg
www.ducks.org/modules/du-templates/images/ui/ 302 B
753 B 498ms
471ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/icon-copy.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

3212ebacef9cb83c0a840ae6ced8e1fc6cb66cf5c24671955e363632f98458cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 3.213.234.199
x-cache: RefreshHit from cloudfront
x-amz-cf-id: VFszMG6EwUXqdMxD9j2-oz894j78ESO5qicoxDV1kmQd2igAeieERw==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 BrowningArms.jpg
www.ducks.org/files/live/sites/ducksorg/files/Hunting/Hunting%20Gear/HistoryOfTheSemiauto/ 321 KB
322 KB 515ms
487ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/Hunting%20Gear/HistoryOfTheSemiauto/BrowningArms.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

8d8d614f6e8f7c50dc312cd636071a99703a11e2ae88d8c4f59528212d0d503b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "1643baef-80dd-40a0-bf95-b4c6883afe97-1726085671844"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 18.235.143.165
x-cache: RefreshHit from cloudfront
content-length: 329158
x-amz-cf-id: gvGyOWD201muJrwhDQlvLyEATQRq89KPbaRWlxuruAFhaE9DcZ91Fg==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Wed, 11 Sep 2024 20:14:31 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 DU%20GunsAndGear%20Banner%20Web%202500px.png
www.ducks.org/files/live/sites/ducksorg/files/Hunting/Digital%20Programs_Sponsors/ 193 KB
194 KB 502ms
475ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/Digital%20Programs_Sponsors/DU%20GunsAndGear%20Banner%20Web%202500px.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

341052fcc09b7f6ca560a8e5797c929ea5b150a61d76614f9d2704dece3bcb14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "e50c4075-a0b3-4a6b-9594-6f9aff9b0593-1725461056154"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
content-length: 197561
x-amz-cf-id: Acrz-MQbi3AulfGv1FXmXxo_ixIL8rleooL8CsbFbyVJ9tXEoDc-2Q==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/png
last-modified: Wed, 04 Sep 2024 14:44:16 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 A%20waterfowler's%20charcuterie%20board.%20John%20Hoffman.jpg
www.ducks.org/files/live/sites/ducksorg/files/Hunting/Recipes/Waterfowler's%20Charcuterie%20Board/ 415 KB
416 KB 518ms
490ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/Recipes/Waterfowler's%20Charcuterie%20Board/A%20waterfowler's%20charcuterie%20board.%20John%20Hoffman.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

5b4cd288d3e8a30cc42ef00d38259343db21dd3544574d170ec681368f78dd37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "ba424505-1362-4dac-98c7-f46e6e173894-1719958905204"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.213.234.199
x-cache: RefreshHit from cloudfront
content-length: 424929
x-amz-cf-id: oDdfwewZNz9S-QWXzBcE2f_iogUlRzZM1Od4vDtSDRtWylycA8paIQ==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Tue, 02 Jul 2024 22:21:45 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 MichaelFurtman_AmericanWigeon.jpg
www.ducks.org/files/live/sites/ducksorg/files/Hunting/migration-alerts/ 140 KB
141 KB 494ms
467ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/migration-alerts/MichaelFurtman_AmericanWigeon.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

96d25b92b0462684cb78553b4897bee19884588ca7cb3df346b520b85ed72824

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "9fe29631-d295-4048-a76b-23da3604ecbe-1727732667454"
age: 26
x-content-type-options: nosniff
x-resolver-ip: 18.235.143.165
x-cache: Hit from cloudfront
x-amz-cf-id: bpFJh5gvCUpFAYhlIdw2bo4FcItc30q-eyQ-hww1O-91dITqaTX03w==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Mon, 30 Sep 2024 21:44:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 143804
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 MichaelFurtman_Mallard.jpg
www.ducks.org/files/live/sites/ducksorg/files/Hunting/migration-alerts/ 166 KB
166 KB 495ms
468ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/migration-alerts/MichaelFurtman_Mallard.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

d57f101b5c28ce7231b16adbbf13fc9793ede3248fa2c882fc5f392a6586b446

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "cbcf47c1-ed6a-4e6d-ae25-ad14b4035460-1727453126076"
age: 23
x-content-type-options: nosniff
x-resolver-ip: 3.213.234.199
x-cache: Hit from cloudfront
x-amz-cf-id: dsU3UgLkkFvXafRTZLHI4_rtC5MC1nzfQKNYSkO9F-VjkDkCDBEe0Q==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Fri, 27 Sep 2024 16:05:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 169715
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 michaelfurtman.jpg
www.ducks.org/files/live/sites/ducksorg/files/Hunting/migration-alerts/ 183 KB
184 KB 499ms
473ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/migration-alerts/michaelfurtman.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

6bdf7b45a11586c1dde75bec21a4a237ccf490e20772756f21f0b3ac08e57ed7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "e923b96d-27a1-4569-9e67-45e55b41e6dc-1727362877326"
age: 23
x-content-type-options: nosniff
x-resolver-ip: 18.235.143.165
x-cache: Hit from cloudfront
x-amz-cf-id: JTzlz6eVkznws4JV7nCEXXN2upUBAuV8cTLDmwol7ViEC9hq0BHq4A==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Thu, 26 Sep 2024 15:01:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 187498
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 JohnHafner_Lead.jpg
www.ducks.org/files/live/sites/ducksorg/files/Hunting/Retriever%20Training/the-ready-retriever/ 187 KB
188 KB 498ms
472ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Hunting/Retriever%20Training/the-ready-retriever/JohnHafner_Lead.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

19a80fd2c4ca6a8628967408dfce1768933d9d8f26ae617255b6faeecf545451

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "6bbcf609-1883-4e19-ade2-58ea7a9b1e9e-1727214941960"
age: 32
x-content-type-options: nosniff
x-resolver-ip: 18.213.84.67
x-cache: Hit from cloudfront
x-amz-cf-id: 0Gl0VLai_9aGUr0WcrV061KGFKC1ubP329Q0-YbASoElckPjHXMS_w==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Tue, 24 Sep 2024 21:55:41 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 191767
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 image%2072.svg
www.ducks.org/files/live/sites/ducksorg/files/ 480 KB
480 KB 500ms
475ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/image%2072.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

9924c9ea04d10f130b3fe95b0e54529e1928300323430fd7b0f22e00dce0a425

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
etag: W/"9ba0837b-0e89-4652-962b-b45cf0118a6a-1677699391383"
x-content-type-options: nosniff
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
x-amz-cf-id: rXmJFTCWnxbLLK5o41uMv98w0Jgsz0-iahkzPXhe4en15XAq6oAPLg==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Wed, 01 Mar 2023 19:36:31 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 dropdown-arrow.svg
www.ducks.org/modules/du-base-components/images/ 152 B
667 B 498ms
473ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-base-components/images/dropdown-arrow.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

77cb8ad87f43ae7ebcbeb49721cee249836f425195644da54daf56b01a53b8e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
age: 51
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 02:59:14 GMT
x-resolver-ip: 3.233.88.158
x-cache: Hit from cloudfront
x-amz-cf-id: RQDS61NPlwj1jBY0myC0TJPYTDzrbeSJ-l2bE3M_DvRlZaT3PVWPJA==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 17:14:39 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 du-magazine.png
www.ducks.org/modules/du-templates/images/ui/ 67 KB
67 KB 495ms
470ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/du-magazine.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

ff85205ab1c4fe5e1510568c420432d785275715c23d3f611671a92b6ecfb220

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 18.235.143.165
x-cache: RefreshHit from cloudfront
x-amz-cf-id: suBgI8Zrjnkr82B4MhL4liDjWjvG6grpZOC_NXl5O903J3zqPP6XiA==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/png
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 badge-apple-store.png
www.ducks.org/modules/du-templates/images/ui/ 2 KB
2 KB 501ms
477ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/badge-apple-store.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

e8e2bcc73dd1482eb119c643aa5c60e1c52e5c1469c003993eeb26675e980aab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 3.213.234.199
x-cache: RefreshHit from cloudfront
content-length: 1948
x-amz-cf-id: 8biyj-hDnoi5ZLH3Kmhc8Qd0Q420Rxf40b9yMG9aYnZFNAPl9lMp3Q==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/png
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 badge-google-store.png
www.ducks.org/modules/du-templates/images/ui/ 2 KB
3 KB 512ms
488ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/badge-google-store.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

ee11ea7fd40e017a0f38cbfa61d575f8942cc46ed684352b04b31fb689dfe576

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 18.213.84.67
x-cache: RefreshHit from cloudfront
content-length: 2362
x-amz-cf-id: DgJP7bddv5zGyo1cX8aOivQcXayQ8WFfciQ3pLZE3donny2XijgO4A==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/png
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 Apple-Podcasts.png
www.ducks.org/files/live/sites/ducksorg/files/logos/social-media/ 3 KB
4 KB 490ms
467ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/logos/social-media/Apple-Podcasts.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

a43888d0f7f3c84e8dc4c57d846989bcb0d97a96fe72212db8b9ab29eaffcb7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "57cd73d2-e222-4708-8611-944c701b1715-1677038911584"
age: 39
x-content-type-options: nosniff
x-resolver-ip: 3.233.88.158
x-cache: Hit from cloudfront
x-amz-cf-id: nET_mYvuKCtB_DfdZvQ4ANNMBN1XVHfvlsw2fPod1cntYedH2-L3Lw==
date: Wed, 02 Oct 2024 16:29:33 GMT
content-type: image/png
last-modified: Wed, 22 Feb 2023 04:08:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 3467
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 Spotify.png
www.ducks.org/files/live/sites/ducksorg/files/logos/social-media/ 2 KB
3 KB 393ms
370ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/logos/social-media/Spotify.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

c0cf6e482137a2b89de217e472c0fd200e55e9cd3ea8a5ae4c7ce30603d07a94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "1ed87faf-8f09-434e-a439-7517b95e161c-1677038911389"
age: 39
x-content-type-options: nosniff
x-resolver-ip: 3.213.234.199
x-cache: Hit from cloudfront
x-amz-cf-id: JstqlFn7btu81Tp9FIMx1i4_n_RQaFULiiHkvxFQ9GNkrGOSSUXJRQ==
date: Wed, 02 Oct 2024 16:29:33 GMT
content-type: image/png
last-modified: Wed, 22 Feb 2023 04:08:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 2315
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 YouTube.png
www.ducks.org/files/live/sites/ducksorg/files/logos/social-media/ 2 KB
2 KB 394ms
371ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/logos/social-media/YouTube.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

69d72f4f5abb3e30b705273a1b8f9ef7adfeaa861d063dc41a1776f43b4213fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "eb00d98e-f609-4deb-8699-8c647eb0cfd8-1677038911484"
age: 39
x-content-type-options: nosniff
x-resolver-ip: 18.235.143.165
x-cache: Hit from cloudfront
x-amz-cf-id: CIRBVMDnf1pE8jMuzDoyJ4pr_8iGKJyrjHLAY4ajtKyJ4vfhhVPV9A==
date: Wed, 02 Oct 2024 16:29:33 GMT
content-type: image/png
last-modified: Wed, 22 Feb 2023 04:08:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 1868
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 nationalbblogowin23_rgb.png
www.ducks.org/files/live/sites/ducksorg/files/Footer/ 28 KB
28 KB 395ms
373ms Image
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/Footer/nationalbblogowin23_rgb.png

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

faa4a82cd95d8230f6fa5024685dfd36e06f1b8085bab44b98193bb14f021add

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: "7fb59d97-dc75-42fb-a5cd-0b880a1cc44e-1696015626100"
age: 39
x-content-type-options: nosniff
x-resolver-ip: 3.233.88.158
x-cache: Hit from cloudfront
x-amz-cf-id: blt-eZv_DWS6-xnNsF0j4Y9As3jyaYeaDvGLDSLfIoRslOHjG0_gPw==
date: Wed, 02 Oct 2024 16:29:33 GMT
content-type: image/png
last-modified: Fri, 29 Sep 2023 19:27:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
content-length: 28367
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 icon-facebook.svg
www.ducks.org/modules/du-templates/images/ui/ 368 B
825 B 513ms
491ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/icon-facebook.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

41f6f94451d85490ab6ae9f47879b02c77b39144ffb25ef6cec7748a45fc1cc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
x-amz-cf-id: 6oOllqL4SbrBCDoshafeuhrXzqLpAmtb9ibLVMy7TpqywWEKpAwmtA==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 icon-x.svg
www.ducks.org/modules/du-templates/images/ui/ 599 B
983 B 512ms
490ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/icon-x.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

15530d9ada4870ef8402ca4236cae63da8e660d12fbda0a6f9488bb68080491a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 18.213.84.67
x-cache: RefreshHit from cloudfront
x-amz-cf-id: vImB9PiGYYcGCUKCVUr5T-pEzDaGMWEGH1IxtuNineXxDJwPFpa8bg==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 icon-instagram.svg
www.ducks.org/modules/du-templates/images/ui/ 2 KB
2 KB 510ms
489ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/icon-instagram.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

f2dbfcf6f1472d0b5a5310d6935dfe414f53f3fea0001a0b32890a4b71e58beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 18.235.143.165
x-cache: RefreshHit from cloudfront
x-amz-cf-id: NLPQcFpoK2-gwHNjn1cknjzBC_qjGFCfEi3PtDThwy8ZFo7n7bovEg==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 icon-tiktok.svg
www.ducks.org/modules/du-templates/images/ui/ 1 KB
2 KB 491ms
471ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/icon-tiktok.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

a93c4c693046b143cc3a1a7c5b337df32f5265a68afe6a5483bd485d868301ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 3.233.88.158
x-cache: RefreshHit from cloudfront
x-amz-cf-id: Rbm1FuSIPyv8wFBomSEFqsYzYI0M4dxuRlVFYiX4etBNvngoSHcF-Q==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 icon-youtube.svg
www.ducks.org/modules/du-templates/images/ui/ 783 B
975 B 508ms
490ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/icon-youtube.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

98f41a78867d2fdf26ea05f82e675a406091a744991912af96341b5e17a06a1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 3.213.234.199
x-cache: RefreshHit from cloudfront
x-amz-cf-id: hdbzh0pXS3KYwP_AsA13AGF53M8t7fpNru5_5Gr2R7XjlZX01ogzuQ==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 icon-linkedin.svg
www.ducks.org/modules/du-templates/images/ui/ 555 B
964 B 489ms
471ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/ui/icon-linkedin.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

172979e6450870385c50490a73957c7d987c375263d4740405f7c5bcc5c9e8a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 18.235.143.165
x-cache: RefreshHit from cloudfront
x-amz-cf-id: _kC2DC63UJTF57wB174_lCt8MTR3IamxqSAZEBgcz18ZBkb9Rs67Dg==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 logo-horizontal.svg
www.ducks.org/modules/du-templates/images/logo/ 17 KB
11 KB 489ms
472ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-templates/images/logo/logo-horizontal.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

b20a071cdfcb68f29a4945d7f223975577258ee4d06529d1f60d10e7cf7a3c15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 18.235.143.165
x-cache: RefreshHit from cloudfront
x-amz-cf-id: PfnE-RvFmsHxPxZYJWjIVgQOmg12nLSg3-3YphavYuz1gZDeMhDK7Q==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 887 KB
278 KB 545ms
229ms Script
text/javascript 142.250.80.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyCb5uZElNC1vlEUvz4u86Th2R2RoWS9pP8&callback=initMap&libraries=places,marker

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.74 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f10.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

a97207e0d8e9103e2413d4a919d3f67b3626d74039a05e2d0c8aacac87138ac2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: public, max-age=1800
timing-allow-origin: *
content-encoding: gzip
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 283769
date: Wed, 02 Oct 2024 16:30:05 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
vary: Accept-Language, Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN

GET
H2 200 fb5f95de8ac0dc9487219f145c54b740-defer.min.js Show response
www.ducks.org/generated-resources/ 74 KB
74 KB 493ms
476ms Script
text/javascript 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ducks.org/generated-resources/fb5f95de8ac0dc9487219f145c54b740-defer.min.js

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

a9f18a060ea2608fd9065cb888b1b71962ad495077024ccd8d7d8401d4bd578b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

etag: fb5f95de8ac0dc9487219f145c54b740-defer.min.js_75440_1727768645019
x-content-type-options: nosniff
expires: Wed, 09 Oct 2024 16:30:05 GMT
x-resolver-ip: 3.213.234.199
x-cache: Miss from cloudfront
x-amz-cf-id: BAVlLxpU8BE3dPS0yqsZix-9XIhBAqxqYRc8T4ygMm65ByBfTydNPQ==
date: Wed, 02 Oct 2024 16:30:05 GMT
last-modified: Tue, 01 Oct 2024 07:44:05 GMT
content-type: text/javascript;charset=UTF-8
vary: Accept-Encoding
content-disposition: inline;filename="fb5f95de8ac0dc9487219f145c54b740-defer.min.js"
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private
content-range: bytes 0-75439/75440
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 75440
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 375 KB
121 KB 177ms
160ms Script
application/javascript 142.251.40.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

876c808f691118d5a8f29e15f35c1d4d853fcee5f22e5265ab5cb98a9a65e157

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 02 Oct 2024 15:59:53 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 123978
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 ping.min.js Show response
pixel.byspotify.com/ 22 KB
22 KB 251ms
77ms Script
text/javascript 34.117.162.98
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.byspotify.com/ping.min.js
Requested by: Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.117.162.98 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 98.162.117.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 42e2dd427dd9f9d45367c880c68289114b7de56373ff8bdc664ea0fa3ce77880

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=NZyeaA==, md5=Tt3uyVr9qWmz0bL7lwwesQ==
etag: "4eddeec95afda969b3d1b2fb970c1eb1"
age: 1000
x-goog-stored-content-encoding: identity
expires: Wed, 02 Oct 2024 17:13:25 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 22096
date: Wed, 02 Oct 2024 16:13:25 GMT
last-modified: Tue, 25 Jun 2024 13:55:33 GMT
content-type: text/javascript
x-guploader-uploadid: AD-8ljsJXOHsyxy1drLv2pV8gx-a9XAVPRqOTt6f0OWZwsfplw628NSC0W4dyXlHW3MMSv3vrrGWOk_QPw
cache-control: public, max-age=3600
x-goog-storage-class: STANDARD
via: 1.1 google
accept-ranges: bytes
x-goog-generation: 1719323733334567
content-length: 22096
server: UploadServer

GET
H2 200 968fae2e
share.transistor.fm/e/ Frame 4956 0
0 251ms
78ms Document
text/html 151.101.195.52
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://share.transistor.fm/e/968fae2e

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.195.52 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2868
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: max-age=0, public, must-revalidate
content-encoding: br
content-length: 30674
content-type: text/html; charset=utf-8
date: Wed, 02 Oct 2024 16:30:05 GMT
etag: W/"0112b943c39b2da73387b89b799675f2"
link: <https://assets.transistor.fm/assets/embeds-6f76db08348c644078a47cd9c345e758c07f745809bcdaec3750189a12824ea3.css>; rel=preload; as=style; nopush
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31557600
vary: Accept-Encoding
via: 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT
x-cache-hits: 4, 0
x-cdn-eid: 2092148
x-cdn-sid: 39974
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-request-id: 0fdf7e23-5534-4203-8d9b-489489bdef04
x-robots-tag: noindex, nofollow
x-runtime: 0.046475
x-served-by: cache-iad-kiad7000047-IAD, cache-den8253-DEN
x-timer: S1727886606.547300,VS0,VE1
x-xss-protection: 0

GET
H2 200 r3kmeAoEEgw
www.youtube.com/embed/ Frame E23C 0
0 461ms
213ms Document
text/html 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/r3kmeAoEEgw?si=HEjoUZNRzCcwDRa3

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-security-policy: require-trusted-types-for 'script'
content-security-policy-report-only: base-uri 'self';default-src 'self' https: blob:;font-src https: data:;img-src https: data: android-webview-video-poster:;media-src blob: https:;object-src 'none';report-uri /cspreport/common;script-src 'report-sample' 'nonce-s4hr5lqEVvuc7jgO0N_Y0Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';style-src https: 'unsafe-inline'
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:05 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 0Cc11cFzgSc
www.youtube.com/embed/ Frame B9A0 0
0 457ms
214ms Document
text/html 142.251.40.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/0Cc11cFzgSc?si=zy7tqrXkH4No39Tf

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.238 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f14.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-security-policy: require-trusted-types-for 'script'
content-type: text/html; charset=utf-8
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:05 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
32 KB 264ms
131ms Font
font/woff2 142.251.40.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100..900;1,100..900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.227 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f3.1e100.net

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.ducks.org
Referer: https://fonts.googleapis.com/

Response headers

age: 28209
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 08:39:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 08:39:56 GMT
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 33092
x-xss-protection: 0
server: sffe

GET
H2 200 Mossy%20Oak_Bottomland.jpg
www.ducks.org/files/live/sites/ducksorg/files/hero-images/ 226 KB
227 KB 491ms
487ms Image
image/jpeg 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/files/live/sites/ducksorg/files/hero-images/Mossy%20Oak_Bottomland.jpg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/generated-resources/2d91f13f4530b82b88a5cf164f706358.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

183e25f10a5a556ed868cbb40e4e7c905377574e09e908440f0a96e0abbdb9d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/generated-resources/2d91f13f4530b82b88a5cf164f706358.min.css

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, must-revalidate, max-age=1, private
etag: "1ce3cfc1-6d1f-44c4-873a-82a7edfb95da-1693535548038"
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-resolver-ip: 3.213.234.199
x-cache: RefreshHit from cloudfront
content-length: 231656
x-amz-cf-id: 0jIxtYaxocKZTzwQhwnAZw_hNj_yRqTOcQemWqqHhevIxjb1BYgAFQ==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/jpeg
last-modified: Fri, 01 Sep 2023 02:32:28 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H2 200 donate-step-check.svg
www.ducks.org/modules/du-base-components/images/ 255 B
745 B 455ms
454ms Image
image/svg+xml 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.ducks.org/modules/du-base-components/images/donate-step-check.svg

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/generated-resources/2d91f13f4530b82b88a5cf164f706358.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

26c66fa725fbf034c9579e5587f2d02b75355bc14fe899a94326019c1e574dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/generated-resources/2d91f13f4530b82b88a5cf164f706358.min.css

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 02 Nov 2024 03:00:05 GMT
x-resolver-ip: 3.213.234.199
x-cache: RefreshHit from cloudfront
x-amz-cf-id: o8WUrbRLZvmPuUNyscntNaF_001o8VOLb45BRiUY-hdGxz7PkuAg6g==
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: image/svg+xml
last-modified: Thu, 26 Sep 2024 17:14:39 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block;
x-amz-cf-pop: JFK50-P8
server: openresty

GET
H3 200 JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2
fonts.gstatic.com/s/montserrat/v26/ 33 KB
34 KB 225ms
140ms Font
font/woff2 142.251.40.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUQjIg1_i6t8kCHKm459WxRyS7m.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100..900;1,100..900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.227 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f3.1e100.net

Software

sffe /

Resource Hash

92443d06835a28423649bca60e6d755e4a1bd09638443196d58e0dd1f06c827f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.ducks.org
Referer: https://fonts.googleapis.com/

Response headers

age: 14591
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 12:26:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 12:26:54 GMT
last-modified: Wed, 13 Sep 2023 22:52:07 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34288
x-xss-protection: 0
server: sffe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 273 KB
94 KB 150ms
148ms Script
application/javascript 142.251.40.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-976631994&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-10231870

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c7023059f33d393d808153256e01db33116be50bbf38cbe54dce1705b5c90c41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 02 Oct 2024 15:59:53 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96251
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 www.ducks.org.json Show response
script.crazyegg.com/pages/data-scripts/0113/4211/site/ Frame 2BAB 9 KB
3 KB 189ms
102ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0113/4211/site/www.ducks.org.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0113/4211.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e1356be068a3ddf9dcc7ba89e5efc6a28081ca58335bfaf76b9d8169a485c1eb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 12070
alt-svc: h3=":443"; ma=86400
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/json
last-modified: Wed, 02 Oct 2024 13:08:55 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8cc6133598e767df-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2851
ce-version: 11.5.286
server: cloudflare

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 283 KB
81 KB 430ms
430ms Script
application/x-javascript 31.13.71.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=95e2ee78bb9bc804e221b6bdf3c4abf7

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-lga3.fbcdn.net

Software

Resource Hash

5fde01dbdbdd1601aa54302a90e1528270a854062f96671d16232be20792829a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.ducks.org
Referer: https://www.ducks.org/

Response headers

content-md5: wArHC0DTupJTKNKMg/nTCg==
access-control-expose-headers: X-FB-Content-MD5
content-encoding: gzip
etag: "d1155b925c01ec6e6cb3aa50a8a54584"
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 16:07:56 GMT
alt-svc: h3=":443"; ma=86400
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5: 210edb12a7b10718626c6705d821d56d
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: GOOD; q=0.7, rtt=131, rtx=0, c=29, mss=1232, tbw=12239, tp=22, tpl=0, uplat=0, ullat=-1
x-fb-debug: TvHo7jZYM54E7h2eExpYDeoZCruLpsAJwlKkbES8vTDPLv6nNr6a76iG6Y78KaXF8+dyH6qCZyQRJKTUaEdR4Q==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
access-control-allow-origin: *
content-length: 82676
origin-agent-cluster: ?1

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 299 KB
101 KB 175ms
175ms Script
application/javascript 142.251.40.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2X0ECQZQ09&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e4c69c2ae010da4ce119a3bd26a3f2fe4e050e55e5524db03ab455596b9363f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 103123
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 226 KB
58 KB 330ms
164ms Script
application/x-javascript 31.13.71.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-lga3.fbcdn.net

Software

Resource Hash

aa9185ab1bfe6ccdf160f859377f2c8ed3b102c7a083bbbfb30d2ea3f26ff31f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: MODERATE; q=0.3, rtt=162, rtx=0, c=24, mss=1232, tbw=8204, tp=13, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: PKb7EoX3C1R7Cs3GJzXe8DXEX0b/KOqMA1sSAAC8lc23PD8I4N+ReUA16FuI6+Qqgfk6rHsgkoBwxhtlSNkaNQ==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 59127
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H2 200 bat.js Show response
bat.bing.com/ 49 KB
15 KB 685ms
113ms Script
application/javascript 150.171.27.10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: gzip
etag: "803483b3aaadb1:0"
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7AAE7103C84740F2B3424F9E2D530949 Ref B: SJC211051205021 Ref C: 2024-10-02T16:30:06Z
accept-ranges: bytes
x-cache: CONFIG_NOCACHE
content-length: 14402
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/javascript
last-modified: Thu, 19 Sep 2024 15:43:41 GMT
vary: Accept-Encoding

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 273 KB
94 KB 191ms
190ms Script
application/javascript 142.251.40.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-976631994&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

10e55e569ca31476055f4e4d330518740109bfc635e445073c31cf278a8add37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 02 Oct 2024 15:59:53 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96173
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 273 KB
94 KB 342ms
342ms Script
application/javascript 142.251.40.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-1040837785&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e2da86eaef8736d5928c8cf39e43470248e6fc545568b9659d4e3314bf5020c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 02 Oct 2024 15:59:53 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 95988
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 218 KB
78 KB 292ms
291ms Script
application/javascript 142.251.40.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-10231870&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

65d76c2b6aaed27e43b6910243253ba795ed6db95ef8b9f619ae7274981eafab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Wed, 02 Oct 2024 16:30:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 02 Oct 2024 15:59:53 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80148
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 667ms
131ms Script
text/javascript 142.251.40.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
age: 1442
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 18:06:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:06:04 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 20994
server: Golfe2

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 42 KB
13 KB 606ms
76ms Script
application/javascript 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 1593b1f5bf86a2bec3f93142409030a64591d1b6415faaedd0c251dd924d0288

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: public, max-age=60
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding: gzip
etag: "bed9b675380c07edc84c03d0f362b192"
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
content-length: 12103
date: Wed, 02 Oct 2024 16:30:06 GMT
last-modified: Mon, 23 Sep 2024 17:14:22 GMT
content-type: application/javascript
vary: Accept-Encoding,Origin
server: snooserv
x-amz-server-side-encryption: AES256

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 40 KB
14 KB 678ms
150ms Script
application/javascript 23.200.3.26
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.3.26 Edison, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-3-26.deploy.static.akamaitechnologies.com

Software

Resource Hash

4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: max-age=32981
content-encoding: gzip
x-cdn: AKAM
x-content-type-options: nosniff
accept-ranges: bytes
content-length: 14628
date: Wed, 02 Oct 2024 16:30:06 GMT
last-modified: Thu, 22 Aug 2024 11:06:54 GMT
content-type: application/javascript;charset=utf-8
vary: Accept-Encoding
x-amz-server-side-encryption: AES256

GET
H2 200 6b3a1a5d169fdb4d107f86a6269a5d3cebceb605.js Show response
my.hellobar.com/ 2 KB
1 KB 638ms
110ms Script
text/javascript 104.22.14.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://my.hellobar.com/6b3a1a5d169fdb4d107f86a6269a5d3cebceb605.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.14.23 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48fc55e6489e48dc026828fb2b4ed40d094272ff65405cc7cc039e94d6f9895a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

x-amz-server-side-encryption: AES256
cache-control: max-age=86400, must-revalidate, proxy-revalidate, s-maxage=10
content-encoding: br
cf-bgj: minify
etag: W/"76b409c4019f4ee025881ccb96ec493d"
age: 5
cf-cache-status: HIT
x-amz-request-id: 159P2QBRRMBWYJPT
cf-ray: 8cc613394c51a916-DFW
date: Wed, 02 Oct 2024 16:30:06 GMT
content-type: text/javascript
last-modified: Mon, 30 Sep 2024 19:24:48 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: pVowrqRn8a/4BFVXvzmQYwXu7oLt3hRgKXwlWEKBLl3sNSZi0IONDpCLjKgCyEOKaakVvYpS8JM=

GET
H2 200 events.js Show response
analytics.tiktok.com/i18n/pixel/ 7 KB
3 KB 680ms
153ms Script
application/javascript 23.206.172.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C0GQ1JCP76SVVJ0UQN7G&lib=ttq
Requested by: Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.172.82 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-206-172-82.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 176f870235db68c0cd4c6c29c562f543dc46e485aa811eff9512b4cad122286d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
x-cache-remote: TCP_MISS from a23-220-104-211.deploy.akamaitechnologies.com (AkamaiGHost/11.6.4-e26983a004e229b4ffa935b6e3b2fe8f) (-)
expires: Wed, 02 Oct 2024 16:30:06 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=8, origin; dur=8, inner; dur=5
x-cache: TCP_MISS from a23-58-89-47.deploy.akamaitechnologies.com (AkamaiGHost/11.6.4-e26983a004e229b4ffa935b6e3b2fe8f) (-)
date: Wed, 02 Oct 2024 16:30:06 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
x-akamai-request-id: b39bd98f.5f5e963
x-tt-trace-host: 0118f2588c390fdf206439d066ff65f42b2956466d8ad65ff2df370e5f799f6224d8eca781e1b55c5554f278c4dad6a7f714612a0de46aaf9608be9b91aae7026d14fd3d6704593ab52064c0e07507259ec02afa8fc947d3962de460028588ab6f019572bea3696f874615f93459a7993c
x-origin-response-time: 8,23.220.104.211
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-tt-trace-id: 00-2410021630063D8837FFA0C7044AF535-0A5F7A1740238072-00
content-length: 2100
x-parent-response-time: 16,23.58.89.47
x-tt-logid: 202410021630063D8837FFA0C7044AF535
server: nginx

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 14 KB
6 KB 694ms
171ms Script
application/x-javascript 108.139.33.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 108.139.33.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-139-33-128.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 71d18af9ee879a36717e1ea3367b669031e3f6b12cb0aa1373fd200d278c4e6a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Encoding: gzip
ETag: W/"0a898f6edf2d77595f7378557dd8fb96"
Age: 83425
Connection: keep-alive
Via: 1.1 92672fff57a11d8cf4f64313a69242d0.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: OQWu4pI5cG_eEJ8oRIa2sa_UZ6xKR30zIi4plwIJlGhz2npAH8Nvwg==
Date: Tue, 01 Oct 2024 17:19:42 GMT
Content-Type: application/x-javascript
Last-Modified: Thu, 26 Sep 2024 00:49:29 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK50-P2
x-amz-server-side-encryption: AES256

GET

starV6.gif
jelly-v6.mdhv.io/v1/
Redirect Chain

https://jelly.mdhv.io/v1/star.gif?pid=VeyTa07IwUHIJHbvty1l6y9yE8BK&src=mh&evt=hi
https://jelly-v6.mdhv.io/v1/starV6.gif?evt=hi&pid=VeyTa07IwUHIJHbvty1l6y9yE8BK&src=mh&tx=59ee2c00-8f66-42b8-86fd-8ec2a27f5492

0
0

GET
H3 200 77e0e5b3eaafb9598d84738ee0f866ec.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 103 KB
35 KB 97ms
96ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/77e0e5b3eaafb9598d84738ee0f866ec.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0113/4211.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc3175e277f0f116e9d83d1e6e34f21bc7712208dd1bd99bdba78db50f9c6182

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 73318
cf-ray: 8cc6133649825388-DEN
cf-polished: origSize=105436
access-control-allow-origin: *
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: text/javascript
last-modified: Mon, 23 Sep 2024 17:02:13 GMT
vary: Accept-Encoding
server: cloudflare

POST
H2 200 ingest Show response
pixels.spotify.com/v1/ 52 B
270 B 134ms
131ms Fetch
application/json 35.186.224.24
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pixels.spotify.com/v1/ingest

Requested by

Host: pixel.byspotify.com
URL: https://pixel.byspotify.com/ping.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.24 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

24.224.186.35.bc.googleusercontent.com

Software

envoy /

Resource Hash

3605cb71891f707a7a7545666b88aa126749bbec0bfa36d4530a6dd807210ff2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.ducks.org/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json
Content-Type: application/json

Response headers

strict-transport-security: max-age=31536000
grpc-status: 0
content-encoding: gzip
x-envoy-upstream-service-time: 1
x-content-type-options: nosniff
via: HTTP/2 edgeproxy, 1.1 google
grpc-accept-encoding: gzip,x-snappy-framed
access-control-allow-origin: https://www.ducks.org
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:05 GMT
content-type: application/json
vary: Accept-Encoding
grpc-encoding: identity
server: envoy

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/976631994/ 5 KB
2 KB 593ms
165ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/976631994/?random=1727886605802&cv=11&fst=1727886605802&bg=ffffff&guid=ON&async=1&gtm=45be4a10z8810428079za201&gcd=13l3l3l3l1l1&dma=0&tag_exp=99312314~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-976631994&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

690cd387ead73cd9f97afe3e29fe37200fe6adddecd182f61a734870ebab1123

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2377
date: Wed, 02 Oct 2024 16:30:06 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 976631994
td.doubleclick.net/td/rul/ Frame 3E03 0
0 502ms
182ms Document
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/976631994?random=1727886605802&cv=11&fst=1727886605802&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a10z8810428079za201&gcd=13l3l3l3l1l1&dma=0&tag_exp=99312314~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-976631994&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:06 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 422ms
185ms XHR
application/json 142.250.80.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/modules/CsrfServlet

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.74 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f10.1e100.net

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: private
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
content-encoding: gzip
x-content-type-options: nosniff
access-control-allow-origin: https://www.ducks.org
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
date: Wed, 02 Oct 2024 16:30:06 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
vary: Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN

GET
H2 200 geocoder.js Show response
maps.googleapis.com/maps-api-v3/api/js/58/6/ 6 KB
3 KB 152ms
150ms Script
text/javascript 142.250.80.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/58/6/geocoder.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?key=AIzaSyCb5uZElNC1vlEUvz4u86Th2R2RoWS9pP8&callback=initMap&libraries=places,marker

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.74 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f10.1e100.net

Software

sffe /

Resource Hash

a1cdd9b51c7bf1286774891c3e8e198a14866757d6dd514021af92aafafb8208

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
age: 81969
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
x-content-type-options: nosniff
expires: Wed, 01 Oct 2025 17:43:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 01 Oct 2024 17:43:57 GMT
last-modified: Mon, 23 Sep 2024 19:56:46 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
accept-ranges: bytes
content-length: 2453
x-xss-protection: 0
server: sffe

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/ 478 KB
148 KB 119ms
118ms Script
text/javascript 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

9a373ae6214168509dc4fe047f320b9d27bd87ed907d66806ce9b865ca55042a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
etag: 13004938057169377323
age: 100
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 16:28:26 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 02 Oct 2024 16:28:26 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 151619
x-xss-protection: 0
server: cafe

OPTIONS
H2 200 ingest
pixels.spotify.com/v1/ Frame 0
0 595ms
125ms Preflight 35.186.224.24
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://pixels.spotify.com/v1/ingest
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.224.24 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 24.224.186.35.bc.googleusercontent.com
Software: envoy /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.ducks.org
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-origin: https://www.ducks.org
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Wed, 02 Oct 2024 16:30:06 GMT
server: envoy
vary: Accept-Encoding
via: HTTP/2 edgeproxy, 1.1 google

POST
H2 200 context.json Show response
unomiproduction-ducks.cloud.jahia.com/ 606 B
812 B 539ms
231ms XHR
application/json 18.213.84.67
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://unomiproduction-ducks.cloud.jahia.com/context.json

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/modules/CsrfServlet

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

18.213.84.67 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-213-84-67.compute-1.amazonaws.com

Software

openresty /

Resource Hash

938fed89b32b95728d286f7635cc06391e173181cdf059caec5a06671218d60e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.ducks.org/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: application/json
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
access-control-allow-credentials: true
x-resolver-ip: 18.213.84.67
access-control-allow-origin: https://www.ducks.org
date: Wed, 02 Oct 2024 16:30:06 GMT
content-type: application/json;charset=utf-8
vary: Accept-Encoding
server: openresty

GET
H3 200 1431799027060769 Show response
connect.facebook.net/signals/config/ 68 KB
13 KB 229ms
226ms Script
application/x-javascript 31.13.71.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1431799027060769?v=2.9.170&r=stable&domain=www.ducks.org&hme=d82868061a8c707cd31395a3055e7449daa03bd520872727258c39e6af34523e&ex_m=70%2C120%2C106%2C110%2C61%2C4%2C99%2C69%2C16%2C96%2C88%2C51%2C54%2C171%2C174%2C186%2C182%2C183%2C185%2C29%2C100%2C53%2C77%2C184%2C166%2C169%2C179%2C180%2C187%2C130%2C41%2C34%2C142%2C15%2C50%2C193%2C192%2C132%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C92%2C17%2C14%2C95%2C91%2C90%2C107%2C52%2C109%2C39%2C108%2C30%2C93%2C26%2C167%2C170%2C139%2C28%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C101%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C103%2C102%2C104%2C97%2C10%2C20%2C3%2C38%2C74%2C19%2C85%2C56%2C83%2C33%2C73%2C0%2C94%2C32%2C82%2C87%2C47%2C46%2C86%2C37%2C5%2C89%2C81%2C44%2C35%2C84%2C2%2C36%2C63%2C42%2C105%2C45%2C79%2C68%2C111%2C60%2C59%2C31%2C98%2C58%2C55%2C49%2C78%2C72%2C24%2C112

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

31.13.71.7 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-lga3.fbcdn.net

Software

Resource Hash

a4743123c23b4fe0a43718c295c32ab34635be438878fd4a646d99e246740c19

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src 'unsafe-inline' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
edge-control: cache-maxage=10m
date: Wed, 02 Oct 2024 16:30:06 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' data: blob: *;script-src 'unsafe-inline' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: MODERATE; q=0.3, rtt=160, rtx=0, c=77, mss=1232, tbw=71120, tp=68, tpl=0, uplat=60, ullat=1
pragma: public
x-fb-debug: bM4Ujkx6y+3/XedNd9cXvpxNpEyz4WTtzpxnMfSJ9VHMwsE7DC4lmYNbhPCKfQx0RgvctkdJa+o1/wTKcLOY/w==
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H2 204 collect
analytics.google.com/g/ 0
0 287ms
101ms Fetch
text/plain 216.239.36.181
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-2X0ECQZQ09&gtm=45je4a10v895200442z8810428079za200zb810428079&_p=1727886604837&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101671035~101747727&cid=1482221127.1727886607&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1727886606&sct=1&seg=0&dl=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&dt=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=3032
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2X0ECQZQ09&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 216.239.36.181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.ducks.org
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:06 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
553 B 427ms
144ms Ping
text/plain 142.251.111.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-2X0ECQZQ09&cid=1482221127.1727886607&gtm=45je4a10v895200442z8810428079za200zb810428079&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101671035~101747727
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2X0ECQZQ09&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.111.155 Farmingdale, United States, ASN15169 (GOOGLE, US),
Reverse DNS: bk-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://www.ducks.org
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:06 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul
td.doubleclick.net/td/ga/ Frame 029A 0
0 182ms
181ms Document
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-2X0ECQZQ09&gacid=1482221127.1727886607&gtm=45je4a10v895200442z8810428079za200zb810428079&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101671035~101747727&z=308113939

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2X0ECQZQ09&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:06 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/976631994/ 5 KB
2 KB 173ms
172ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/976631994/?random=1727886606738&cv=11&fst=1727886606738&bg=ffffff&guid=ON&async=1&gtm=45be4a10za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-976631994&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

7430e73ee9a36e97e9bf484512b94c6481e26a4a588ea72fd50d94b2168b0010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2403
date: Wed, 02 Oct 2024 16:30:06 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 976631994
td.doubleclick.net/td/rul/ Frame CCDB 0
0 188ms
187ms Document
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/976631994?random=1727886606738&cv=11&fst=1727886606738&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a10za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-976631994&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:06 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1040837785/ 5 KB
2 KB 176ms
175ms Script
text/javascript 142.250.80.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1040837785/?random=1727886606858&cv=11&fst=1727886606858&bg=ffffff&guid=ON&async=1&gtm=45be4a10z8810428079za201zb810428079&gcd=13l3l3l3l1l1&dma=0&tag_exp=99312313~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1040837785&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.34 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s34-in-f2.1e100.net

Software

cafe /

Resource Hash

8069be5157d53d356db90e2db793e37ba0554a800263b1e27cefacc764f5150e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 2402
date: Wed, 02 Oct 2024 16:30:06 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 1040837785
td.doubleclick.net/td/rul/ Frame 4541 0
0 194ms
193ms Document
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/rul/1040837785?random=1727886606858&cv=11&fst=1727886606858&fmt=3&bg=ffffff&guid=ON&async=1&gtm=45be4a10z8810428079za201zb810428079&gcd=13l3l3l3l1l1&dma=0&tag_exp=99312313~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1040837785&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:06 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 config Show response
pixel-config.reddit.com/pixels/a2_f6qasb0ua3xn/ 3 B
124 B 250ms
80ms XHR
application/json 151.101.129.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-config.reddit.com/pixels/a2_f6qasb0ua3xn/config
Requested by: Host: www.ducks.org
URL: https://www.ducks.org/modules/CsrfServlet
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: max-age=14400
content-encoding: gzip
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: application/json

GET
H2 200 a2_f6qasb0ua3xn_telemetry Show response
www.redditstatic.com/ads/conversions-config/v1/pixel/config/ 86 B
699 B 243ms
86ms XHR
application/json 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/a2_f6qasb0ua3xn_telemetry
Requested by: Host: www.ducks.org
URL: https://www.ducks.org/modules/CsrfServlet
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 45da241a91c843b268ada7481cdece1aa679f2720931effea28d83e1398d66a9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: max-age=300
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding: gzip
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 97
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: application/json
vary: Accept-Encoding,Origin
server: snooserv

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 247ms
78ms Image
image/gif 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1727886606920&id=a2_f6qasb0ua3xn&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=536cd42a-8e7c-40a8-8dc0-a76bd9a76188&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_5afed25b&dpm=&dpcc=&dprc=
Requested by: Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
retry-after: 0
cross-origin-resource-policy: cross-origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via: 1.1 varnish
accept-ranges: bytes
content-length: 42
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: image/gif
server: Varnish

GET
H2

200

activityi;dc_pre=CMO-xZuP8IgDFUcgdgYdjjofiw;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv...
10231870.fls.doubleclick.net/ Frame 5C00
Redirect Chain

https://10231870.fls.doubleclick.net/activityi;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;u...
https://10231870.fls.doubleclick.net/activityi;dc_pre=CMO-xZuP8IgDFUcgdgYdjjofiw;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;u...

0
0

205ms
201ms

Document
text/html

142.250.80.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10231870.fls.doubleclick.net/activityi;dc_pre=CMO-xZuP8IgDFUcgdgYdjjofiw;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189890828z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=99312313~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-10231870&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.80.70 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 537
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:07 GMT
expires: Wed, 02 Oct 2024 16:30:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:07 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://10231870.fls.doubleclick.net/activityi;dc_pre=CMO-xZuP8IgDFUcgdgYdjjofiw;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189890828z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=99312313~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 activityi;fledge=1;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0...
td.doubleclick.net/td/fls/rul/ Frame D95F 0
0 186ms
185ms Document
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189890828z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=99312313~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-10231870&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:07 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;register_conversion=1;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl...
ad.doubleclick.net/ 0
22 B 466ms
202ms Image
image/png 172.217.165.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=10231870;type=pagev0;cat=allpa0;ord=1;num=4734760045604;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=547134555;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189890828z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=99312313~101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail?

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s70-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 02 Oct 2024 16:30:07 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"15713474359931478541"}],"aggregatable_trigger_data":[{"filters":[{"14":["10087228"]}],"key_piece":"0x63025b079ab60c6c","source_keys":["12","13","14","15","16","17","18","19","20","21","18268964","18268965","18268966","18268967","18847464","18847465","18847466","18847467","20511712","20511713","20511714","20511715","22075928","22075929","22075930","22075931","22097996","22097997","22097998","22097999","638546844","638546845","638546846","638546847"]},{"key_piece":"0xd836d4f772ab4326","not_filters":{"14":["10087228"]},"source_keys":["12","13","14","15","16","17","18","19","20","21","18268964","18268965","18268966","18268967","18847464","18847465","18847466","18847467","20511712","20511713","20511714","20511715","22075928","22075929","22075930","22075931","22097996","22097997","22097998","22097999","638546844","638546845","638546846","638546847"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"18268964":81,"18268965":81,"18268966":81,"18268967":7946,"18847464":46,"18847465":46,"18847466":46,"18847467":4540,"19":65,"20":65,"20511712":218,"20511713":218,"20511714":218,"20511715":21189,"21":6356,"22075928":72,"22075929":72,"22075930":72,"22075931":7062,"22097996":72,"22097997":72,"22097998":72,"22097999":7062,"638546844":327,"638546845":327,"638546846":327,"638546847":31784},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"16358405888566830596","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"15713474359931478541","filters":[{"14":["10087228"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"15713474359931478541","filters":[{"14":["10087228"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"15713474359931478541","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"15713474359931478541","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["10231870"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H2 200 modules-v2.js Show response
my.hellobar.com/ 321 KB
80 KB 115ms
113ms Script
text/javascript 104.22.14.23
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://my.hellobar.com/modules-v2.js
Requested by: Host: my.hellobar.com
URL: https://my.hellobar.com/6b3a1a5d169fdb4d107f86a6269a5d3cebceb605.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.14.23 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3745507c9933fcd2662e38cb0adc71ec9b89dc596913e5f4c0149cdd3ada10b4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
cf-bgj: minify
etag: W/"aa7eca7ad0c761f529c26540a4193b46"
age: 4205
cf-cache-status: HIT
cf-polished: origSize=328273
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: text/javascript
last-modified: Tue, 17 Sep 2024 13:16:22 GMT
vary: Accept-Encoding
x-amz-id-2: A9EyadestgjuERDvk1IWBOyW4CsgX7d04keizzMFfQqHYUgBzQqVj4IhGSLjLuQWQz1u70fPwLk=
cache-control: max-age=14400
x-amz-request-id: 56WH92S690C4B2FY
cf-ray: 8cc6133e4e6fa916-DFW
server: cloudflare
x-amz-server-side-encryption: AES256

GET
H2 200 5751187.js Show response
bat.bing.com/p/action/ 371 B
419 B 108ms
107ms Script
application/javascript 150.171.27.10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5751187.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0e0c8cedb72a7e5a3080203509132486e267e5d1b0c5c6eae78ac16f7928ff01

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
content-encoding: br
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C324CFC595394BB1BA1DA98551548D2A Ref B: SJC211051205021 Ref C: 2024-10-02T16:30:07Z
x-cache: CONFIG_NOCACHE
date: Wed, 02 Oct 2024 16:30:06 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding

GET
H3 200 topics_frame.html
securepubads.g.doubleclick.net/static/topics/ Frame 8F1F 0
0 448ms
149ms Document
text/html 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 965
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 29417
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:14:02 GMT
expires: Wed, 02 Oct 2024 17:04:02 GMT
last-modified: Mon, 30 Sep 2024 19:42:40 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 51 KB
20 KB 182ms
181ms Fetch
text/plain 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2019486453104884&correlator=1506289177626391&eid=31079956&output=ldjh&gdfp_req=1&vrg=202409260101&ptt=17&impl=fif&iu_parts=1065896%2Ctop&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C320x100%7C300x50%7C970x90%7C1x1%7C728x90&ifi=1&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1727886607148&lmt=1727886607&adxs=436&adys=728&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&vis=1&psz=1600x2505&msz=728x90&fws=4&ohw=1600&td=1&egid=32490&tan=77aa18dd-edef-49b3-b452-ee3d31693b38&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1727886604785&idt=2275&cust_params=section%3DHunting%26keyword%3D%26UUID%3D40d80759-5463-43e8-bb94-2f77fdb125cc&adks=3507658625&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

124e8df86b61a00c5b1cdf77552e3638426cb4505b80434a03d9687c8efc97cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
google-lineitem-id: 6574915433
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138489251492
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.ducks.org
content-length: 20056
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 51 KB
19 KB 177ms
176ms Fetch
text/plain 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2019486453104884&correlator=1506289177626391&eid=31079956&output=ldjh&gdfp_req=1&vrg=202409260101&ptt=17&impl=fif&iu_parts=1065896%2Canchor&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C300x50%7C320x100%7C1x1%7C320x50%7C970x90&ifi=2&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1727886607160&lmt=1727886607&adxs=436&adys=5305&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&vis=1&psz=1600x5291&msz=728x90&fws=4&ohw=1600&td=1&egid=32490&tan=77aa18dd-edef-49b3-b452-ee3d31693b39&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1727886604785&idt=2275&cust_params=section%3DHunting%26keyword%3D%26UUID%3D40d80759-5463-43e8-bb94-2f77fdb125cc&adks=126975620&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

1891f036130e664daf89999cfaeb78cbf2d7116bb886c05b1b386d9433a998c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
google-lineitem-id: 6574915433
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138489251489
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.ducks.org
content-length: 19544
x-xss-protection: 0
server: cafe

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 31 KB
14 KB 170ms
170ms Fetch
text/plain 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2019486453104884&correlator=2342348808909279&eid=31079956&output=ldjh&gdfp_req=1&vrg=202409260101&ptt=17&impl=fif&iu_parts=1065896%2COverlay_800x400_Desktop&enc_prev_ius=%2F0%2F1&prev_iu_szs=800x400&ifi=3&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1727886607168&lmt=1727886607&adxs=0&adys=6918&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&vis=1&psz=1600x6814&msz=1600x0&fws=4&ohw=1600&td=1&egid=32490&tan=77aa18dd-edef-49b3-b452-ee3d31693b3a&tdf=2&topics=9&tps=9&htps=10&nt=1&psd=WzE1LFtdLG51bGwsM10.&dlt=1727886604785&idt=2275&cust_params=section%3DHunting%26keyword%3D%26UUID%3D40d80759-5463-43e8-bb94-2f77fdb125cc&adks=3361410454&frm=20&eoidce=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

c7a5a9d453380c5b90175fa0d97313e7b826a7ea36a93b56fa0cbf8b0d365f79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
google-lineitem-id: 6568640622
x-content-type-options: nosniff
google-mediationtag-id: -2
google-mediationgroup-id: -2
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: 138491281211
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://www.ducks.org
content-length: 13845
x-xss-protection: 0
server: cafe

GET
H2 200 container.html
d5db279c1ba4d37ac2ec9a5e42ed6173.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3735 0
0 373ms
128ms Document
text/html 142.250.65.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d5db279c1ba4d37ac2ec9a5e42ed6173.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.225 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:07 GMT
expires: Wed, 02 Oct 2024 16:30:07 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
995 B 133ms
131ms Script
text/javascript 142.251.40.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f14.1e100.net

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
age: 1652
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 17:02:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:02:35 GMT
last-modified: Fri, 30 Jun 2023 18:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 697
x-xss-protection: 0
server: sffe

GET
H2 200 main.MWZkMThhNTg2MA.js Show response
analytics.tiktok.com/i18n/pixel/static/ 336 KB
94 KB 140ms
140ms Script
application/javascript 23.206.172.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWZkMThhNTg2MA.js
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=C0GQ1JCP76SVVJ0UQN7G&lib=ttq
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.172.82 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-206-172-82.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 3fab98a127a8cba049fa0552692f70b455b078103dea0573a1389f32f09732f0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

x-cache: TCP_HIT from a23-58-89-47.deploy.akamaitechnologies.com (AkamaiGHost/11.6.4-e26983a004e229b4ffa935b6e3b2fe8f) (-)
vary: Accept-Encoding
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server-timing: cdn-cache; desc=HIT, edge; dur=0, origin; dur=0, inner; dur=21
x-tt-trace-id: 00-2409261313496BC83C298527384F085D-4105EC0A684B4199-00
content-length: 95318
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: application/javascript; charset=UTF-8
x-tt-logid: 202409261313496BC83C298527384F085D
server: nginx
x-akamai-request-id: 5f5ec9f
x-tt-trace-host: 016102bc2384ece0763cd1cf23265e0b1f842f8f6abc734bfbc6f4bdb196329773b2a2ef71d2f7e3edbadc55272fb255d585868471d291e56e38e4f15c71d2bb99ee43454f1befb331a3eaea7d0bcb8249bc05a3142ab03007bf7e944d5af627bf

GET
H3 200 /
www.google.com/pagead/1p-user-list/976631994/ 42 B
64 B 413ms
154ms Image
image/gif 142.250.80.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/976631994/?random=1727886605802&cv=11&fst=1727884800000&bg=ffffff&guid=ON&async=1&gtm=45be4a10z8810428079za201&gcd=13l3l3l3l1l1&dma=0&tag_exp=99312314~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDpaXnfHFQ0JQnUBxxqjjOAgcm0DfvgcsJlSg&random=66973201&rmt_tld=0&ipr=y

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 02 Oct 2024 16:30:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 www.ducks.org.json Show response
script.crazyegg.com/pages/data-scripts/0113/4211/sampling/ Frame 2BAB 154 B
357 B 105ms
104ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0113/4211/sampling/www.ducks.org.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/77e0e5b3eaafb9598d84738ee0f866ec.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e8c2980a0fcbf254cdcf287b9a6fea312cfe26b6df7bddc6f44be0036321172

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-expose-headers: CE-Version
content-encoding: gzip
cf-cache-status: HIT
age: 16072
alt-svc: h3=":443"; ma=86400
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: application/json
last-modified: Wed, 02 Oct 2024 12:02:15 GMT
vary: Accept-Encoding
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8cc6133f6ef567df-SJC
accept-ranges: bytes
access-control-allow-origin: *
content-length: 143
ce-version: 11.5.286
server: cloudflare

GET
H2 200 attribution_trigger Show response
px.ads.linkedin.com/ 2 B
761 B 330ms
155ms XHR
application/json 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/attribution_trigger?pid=432634&time=1727886607227&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail
Requested by: Host: www.ducks.org
URL: https://www.ducks.org/modules/CsrfServlet
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Referer: https://www.ducks.org/

Response headers

x-li-pop: afd-prod-ltx1-x
content-encoding: gzip
x-fs-uuid: 00062380f373274e3b772530333d1361
x-msedge-ref: Ref A: 1F00807B3CD04875892C8646E286B1DB Ref B: BY3EDGE0311 Ref C: 2024-10-02T16:30:07Z
x-li-fabric: prod-ltx1
x-restli-protocol-version: 1.0.0
access-control-allow-methods: GET, OPTIONS
x-li-uuid: AAYjgPNzJ047dyUwMz0TYQ==
x-li-proto: http/2
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: application/json
access-control-allow-headers: *

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432634&time=1727886607227&li_adsId=8f6f5571-6a0f-41e7-87d7-11e3f34109f8&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsle...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432634&time=1727886607227&li_adsId=8f6f5571-6a0f-41e7-87d7-11e3f34109f8&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsle...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D432634%26time%3D1727886607227%26li_adsId%3D8f6f5571-6a0f-41e7-87d7-11e3f34109f8%2...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432634&time=1727886607227&li_adsId=8f6f5571-6a0f-41e7-87d7-11e3f34109f8&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsle...

0
382 B

169ms
168ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432634&time=1727886607227&li_adsId=8f6f5571-6a0f-41e7-87d7-11e3f34109f8&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&cookiesTest=true&liSync=true
Requested by: Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 934F3235EBFB48BFAA999CBEB1B92959 Ref B: PAOEDGE0617 Ref C: 2024-10-02T16:30:08Z
x-li-fabric: prod-lva1
x-li-uuid: AAYjgPN80sUSHaolJoXcQw==
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: application/javascript

Redirect headers

linkedin-action: 1
x-li-fabric: prod-lva1
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
date: Wed, 02 Oct 2024 16:30:07 GMT
x-frame-options: sameorigin
strict-transport-security: max-age=31536000
x-li-pop: afd-prod-lva1-x
content-security-policy: frame-ancestors 'self'
cache-control: no-cache, no-store
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432634&time=1727886607227&li_adsId=8f6f5571-6a0f-41e7-87d7-11e3f34109f8&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&cookiesTest=true&liSync=true
pragma: no-cache
x-msedge-ref: Ref A: 8563DBD2044946B98BE81D78EE5A03DB Ref B: PAOEDGE0617 Ref C: 2024-10-02T16:30:07Z
x-li-uuid: AAYjgPN56BLhdiqcfVVdUA==
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
269 B 409ms
136ms Image
text/plain 31.13.71.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1431799027060769&ev=PageView&dl=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&rl=&if=false&ts=1727886607268&sw=1600&sh=1200&v=2.9.170&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1727886607266.990395399544870660&ler=empty&cdl=API_unavailable&it=1727886606565&coo=false&tm=1&rqm=GET

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.71.36 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: GOOD; q=0.7, rtt=65, rtx=0, c=10, mss=1380, tbw=2800, tp=-1, tpl=-1, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: text/plain
server: proxygen-bolt

GET
H2 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
3 KB 475ms
204ms Image
image/png 31.13.71.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1431799027060769&ev=PageView&dl=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&rl=&if=false&ts=1727886607268&sw=1600&sh=1200&v=2.9.170&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1727886607266.990395399544870660&ler=empty&cdl=API_unavailable&it=1727886606565&coo=false&tm=1&rqm=FGET

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.71.36 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-lga3.facebook.com

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7421216468271503230"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x529d4391742346de","source_keys":["1"]}],"aggregatable_values":{"1":10922},"filters":{"2":["24:1185448101521920","7830:1185448101521920","10853:1185448101521920","41:1185448101521920","8046:1185448101521920"]},"debug_reporting":true,"debug_key":"2441868609175504191"}
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: 6nyIHPrbWUNdUunOjJzks2RZRB4Zg4U5FkBEUvXWEFtCzHivLaMaDdBxXJodlRT8KIkRQb7q/VL4yh73baS/8Q==
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7421216468271503230", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: GOOD; q=0.7, rtt=65, rtx=0, c=12, mss=1380, tbw=3113, tp=-1, tpl=-1, uplat=67, ullat=0
cross-origin-opener-policy: same-origin-allow-popups
pragma: no-cache
cross-origin-resource-policy: cross-origin
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?0

GET
H3 200 /
www.google.com/pagead/1p-user-list/976631994/ 42 B
64 B 337ms
155ms Image
image/gif 142.250.80.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/976631994/?random=1727886606738&cv=11&fst=1727884800000&bg=ffffff&guid=ON&async=1&gtm=45be4a10za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfjQ0-NMKlU7Ez9qn7_TtsEc5JYNhWN0oZU7jmt5sYCYHc11sg&random=855834671&rmt_tld=0&ipr=y

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 02 Oct 2024 16:30:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 /
www.google.com/pagead/1p-user-list/1040837785/ 42 B
64 B 334ms
153ms Image
image/gif 142.250.80.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1040837785/?random=1727886606858&cv=11&fst=1727884800000&bg=ffffff&guid=ON&async=1&gtm=45be4a10z8810428079za201zb810428079&gcd=13l3l3l3l1l1&dma=0&tag_exp=99312313~101671035~101747727&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&hn=www.googleadservices.com&frm=0&tiba=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&npa=0&pscdl=noapi&auid=1417215480.1727886605&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&fledge=1&rfmt=3&fmt=3&is_vtc=1&cid=CAQSKQDpaXnfAO8nz6jNImJRv9XwfbJFjiQQaIqZ_cO-jbGbi4gT8kZu6TB9&random=1434346051&rmt_tld=0&ipr=y

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-security-policy: script-src 'none'; object-src 'none'
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 02 Oct 2024 16:30:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 204 0
bat.bing.com/action/ 0
360 B 108ms
108ms Image
text/plain 150.171.27.10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5751187&Ver=2&mid=3be4499f-da20-4234-b671-f1d46f9224a3&sid=95e47be080db11ef8c25f1ddcdf9552d&vid=95e4abd080db11ef9fb00df1e4b707d0&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&p=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&r=&lt=2672&evt=pageLoad&sv=1&cdb=AQAQ&rn=784193

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

150.171.27.10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, must-revalidate
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 270286958EE642BAB2E9A5CEF08995D8 Ref B: SJC211051205021 Ref C: 2024-10-02T16:30:07Z
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
date: Wed, 02 Oct 2024 16:30:06 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
420 B 147ms
146ms XHR
text/plain 142.251.40.142
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=194850481&t=pageview&_s=1&dl=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&ul=en-us&de=UTF-8&dt=Duck%20Hunting%20-%20Waterfowl%20Migration%20%7C%20Ducks%20Unlimited&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aChACEAjBAAAACAEO~&jid=1255738004&gjid=1966259638&cid=1482221127.1727886607&tid=UA-171220-25&_gid=510519229.1727886607&_r=1&_slc=1&gtm=45He4a10n81M2LTJJQv810428079za200&cd4=10%2F02%2F2024%2011%3A30%3A05&cd5=1727886605704.vs4czdbi&gcd=13l3l3l3l1l1&dma=0&tag_exp=101671035~101747727&cd3=1482221127.1727886607&z=146630229

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/modules/CsrfServlet

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.40.142 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s80-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://www.ducks.org/

Response headers

report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:07 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://www.ducks.org
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 3
server: Golfe2

GET
H2 200 clock Show response
tracking.crazyegg.com/ Frame 2BAB 38 B
145 B 356ms
128ms XHR
text/plain 18.190.147.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1&tk=5281622e42baedfbc1ed2552a37019ca&u=1134211&s=405056&p=%2Fhunting&v=ceb18cb751e4ba076d8bd015520c15a44d823fc3&f=ducks.org%2Fhunting&ul=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/77e0e5b3eaafb9598d84738ee0f866ec.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.190.147.75 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-190-147-75.us-east-2.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: cfb903af89d7391946a8bbfdfab1ee478f3cf0a94db7d6b2f9473394cb1e40b1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control: no-store
access-control-allow-origin: *
content-length: 38
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: text/plain
server: awselb/2.0

GET
H2 200 healthcheck Show response
pagestates-tracking.crazyegg.com/ Frame 2BAB 19 B
463 B 456ms
133ms XHR
application/json 13.35.93.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pagestates-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/77e0e5b3eaafb9598d84738ee0f866ec.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-8.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 31536000
access-control-expose-headers: Access-Control-Allow-Origin
etag: "d06f04fccf68d0b228a5923187ce1afd"
age: 10142662
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: d5xT_eYD-SxzNydoZRSTFhspfAU_vBRfH8g_ZlYfdUtHRBRjDTZ31Q==
date: Fri, 07 Jun 2024 07:05:46 GMT
content-type: application/json
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
via: 1.1 c7705692ed008dad7e46e32f966aa3fe.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 19
x-amz-cf-pop: JFK50-P8
server: AmazonS3

GET
H2 200 healthcheck Show response
assets-tracking.crazyegg.com/ Frame 2BAB 19 B
462 B 443ms
133ms XHR
application/json 18.238.49.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/77e0e5b3eaafb9598d84738ee0f866ec.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.49.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-49-74.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

access-control-max-age: 31536000
access-control-expose-headers: Access-Control-Allow-Origin
etag: "d06f04fccf68d0b228a5923187ce1afd"
age: 3754890
access-control-allow-methods: GET, HEAD
x-cache: Hit from cloudfront
x-amz-cf-id: lYJ4AyLujKnKkNlSbpr6lp9Zw1tTLiJJtS3gvMCEp6xK4KuO_WM-sQ==
date: Tue, 20 Aug 2024 05:28:38 GMT
content-type: application/json
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
via: 1.1 fb71bc40c2ca2e3f3af674bf6527ac8a.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 19
x-amz-cf-pop: JFK52-P3
server: AmazonS3

GET 54dee2d3-a3d8-4256-9f3b-20b1475df56b
https://www.ducks.org/ Frame 0
0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3277 0
0 179ms
179ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvPtcTfFUkZydeVgRQsCxjtKKadHm1r1FbsKMDwRUh_K8a5YZmlAXOCppyzsG98uzSutIWMkdHLSzGnpLpxAgALkHQZn8z3V8DWFpu88PxQvgNW7XtyBo-xkzEH_ubJ4f0z8ru01EEyCFkksDlB7p3MisYhee6Lc01urUywR-036aL4rDD_eXqJ-OVPouUj-uRax05trzQ-9bvNY08DI5ti2gn4jnuVOO7d50nzN9P22PCZ9IMbThiDmCHliy_4kI29iu6VxEDw7ekYNPDlBXX0C54Wn9iMgFDLAyXmPAIY6aGslspCK-ee_hihSjs8t3ROiU54xR0YqeBSUVVbrIBcSTbWTihzZcJ4BlE4aF7vENZkwIbGp6E&sai=AMfl-YSgJW_6_BY-T0HswyaBI9oeegyfkxeTOL50WvhEvTKj0bmL_UvKill94uGEIqN8qMyKKV4K4kgh6u5MyZoe-gBphd-KmdZ28t0DVj14lMqDfYZDCS7Xt2xw6Es&sig=Cg0ArKJSzDdOPPFHbT8-EAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 02 Oct 2024 16:30:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240930/r20110914/client/ Frame 3277 3 KB
2 KB 461ms
149ms Script
text/javascript 142.250.65.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240930/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.225 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f1.1e100.net

Software

cafe /

Resource Hash

66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
etag: 16544991220582087243
age: 736
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 16:17:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 02 Oct 2024 16:17:51 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1229
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 3277 206 KB
64 KB 451ms
149ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

b0088124edc0322d5cc6c4385ca59c018ceb76790c907d13f1ee5be3dcc1a039

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
etag: 7550679465687725357
age: 471
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 17:22:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 02 Oct 2024 16:22:16 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 65390
x-xss-protection: 0
server: cafe

GET
H2 200 12299538574718827174
tpc.googlesyndication.com/simgad/ Frame 3277 84 KB
85 KB 458ms
150ms Image
image/png 142.250.65.225
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12299538574718827174

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.225 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f1.1e100.net

Software

sffe /

Resource Hash

31898dd32435d144fc8ffe2aaa2302d5710759ba9616a6b67ca2fff0b824f661

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

age: 23473
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 09:58:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 02 Oct 2024 09:58:54 GMT
last-modified: Sat, 14 Sep 2024 21:16:46 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 86445
x-xss-protection: 0
server: sffe

GET l
www.google.com/ads/measurement/ Frame 3277 0
0

GET
DATA 200
OK truncated
/ Frame 3277 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bdb9e6b894c9b64f8ed9e0c7c3ccf8a612480659556a232f06f900473094a31b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FB50 0
0 182ms
181ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssIXmQCCjUbQbY20cgmnfwCVfTp2s0xXu35Ez82SlVru0NlgHAqNlNNXlrFm8P1w4vEIKHp4S7JGe3vmVuKZ3M2lkqtb3m2rSPBWptE47QhRBH8LvjOX6OJt8MaZSWHmjD2HYJJX8edFZaL99gDDss4hDcsVUvaOWTtLSDLBtvYXpCx4w97f93uR_peWl-IkzXFfQpOX4vqmcmTCnz-SMHFBqWSffAEWPSasSkiAHpJqms9u5An1z67nYiQdebGkflOMyp83EY8-QyAT22JqaRLhsTW06jEvt5SmmURhffcNKV3GDb_BVqMjE5oXv1PfOZ7y217aYaPSmGGpLsQc4PlPIImMVhlsapSX4wSoa8K99GhfogLYu33FNlDiCiu9aPTJpUJzKZWcFXyPYqVJdXizTRaZeaRVg&sai=AMfl-YRah6wsI_puwqP5DHYpFSbSUhLtW2i7zHEkiuvAeD9SUhwuS8c6asDGfW4jYtg12mZgsCWnbSqIuzwWtcaqEhGtzDPWGEDZ12i4_YrhMlizv1fXoibfBl3JStMP&sig=Cg0ArKJSzBOXeQrKTq_FEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 02 Oct 2024 16:30:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame FB50 206 KB
0 407ms
407ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

b0088124edc0322d5cc6c4385ca59c018ceb76790c907d13f1ee5be3dcc1a039

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
etag: 7550679465687725357
age: 471
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 17:22:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 02 Oct 2024 16:22:16 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 65390
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4C0D 0
0 178ms
177ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvt4OVHAI1Y3jKcR121tusX1aHHrCSDLJ7hY-KL5lUnrL49cRXjH2JCnx1CmS2pY73jeoPg_Cb59NuSSi_uyKcC_5jjM3K-jpSl5eyAQcBUSXVKWgkM5H0QJ4oIlmhiT7KHmkJCsgrsPkf2we_Yp79vEaGNyXCOysyCdcXL7LGc_6XO5LswvT7_-ZhRxyWwdXu2G5GLpV_iWZxH7MoK6cjPse0uaQoE0AZkLaYesOeoN1Nqkch24M8uIQfLo4syfGasn8quXM2EvptqHnddh62Yrf2k2NjTJa9XKMlE1LBnLosOhI6fWp6DRxcL34fpq5IiNtsiYtkzeacVd4xbHFjmrDpcJZKqZqQDknykP0-9BBmnTnNUVJ1mt1k&sai=AMfl-YSG23ePoqJC3Qe3YeTygMWsv2GQv5_1VwODYl5pilUVBaXHMJX5qMUznktOXsRuWkb_vgpNzgYiVNpUUyYGRdQ-YbE2R_X2JtaZ1bp_dg4tp7e-_s_MG6187spD&sig=Cg0ArKJSzLmh8Oauy3zOEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 02 Oct 2024 16:30:07 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 12299538574718827174
tpc.googlesyndication.com/simgad/ Frame 4C0D 84 KB
0 395ms
395ms Image
image/png 142.250.65.225
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12299538574718827174

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.225 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f1.1e100.net

Software

sffe /

Resource Hash

31898dd32435d144fc8ffe2aaa2302d5710759ba9616a6b67ca2fff0b824f661

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

age: 23473
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 09:58:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Wed, 02 Oct 2024 09:58:54 GMT
last-modified: Sat, 14 Sep 2024 21:16:46 GMT
content-type: image/png
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
content-length: 86445
x-xss-protection: 0
server: sffe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240930/r20110914/client/ Frame 4C0D 3 KB
0 393ms
393ms Script
text/javascript 142.250.65.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240930/r20110914/client/window_focus_fy2021.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.225 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f1.1e100.net

Software

cafe /

Resource Hash

66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
etag: 16544991220582087243
age: 736
x-content-type-options: nosniff
expires: Wed, 16 Oct 2024 16:17:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 02 Oct 2024 16:17:51 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1229
x-xss-protection: 0
server: cafe

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 4C0D 206 KB
0 379ms
379ms Script
text/javascript 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

b0088124edc0322d5cc6c4385ca59c018ceb76790c907d13f1ee5be3dcc1a039

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
etag: 7550679465687725357
age: 471
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 17:22:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Wed, 02 Oct 2024 16:22:16 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 65390
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame 4C0D 0
0

GET
H2 200 identify_7bf75739.js Show response
analytics.tiktok.com/i18n/pixel/static/ 146 KB
39 KB 178ms
175ms Script
application/javascript 23.206.172.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/i18n/pixel/static/identify_7bf75739.js
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWZkMThhNTg2MA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.172.82 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-206-172-82.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 79951b5bd4d729a2b2f4d380819f2c14bbcf26f21db56a520189633467766cf4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

x-cache: TCP_MEM_HIT from a23-58-89-47.deploy.akamaitechnologies.com (AkamaiGHost/11.6.4-e26983a004e229b4ffa935b6e3b2fe8f) (-)
vary: Accept-Encoding
cache-control: public, max-age=31536000, immutable
content-encoding: gzip
x-tt-trace-tag: id=16;cdn-cache=hit;type=static
server-timing: cdn-cache; desc=HIT, edge; dur=0, origin; dur=0, inner; dur=9
x-tt-trace-id: 00-2408300225272DCF0E49A25075B1263C-578A250FEB8B6FD1-00
content-length: 39485
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: application/javascript; charset=UTF-8
x-tt-logid: 202408300225272DCF0E49A25075B1263C
server: nginx
x-akamai-request-id: 5f5edc8
x-tt-trace-host: 01219296fdbd6215c6ae9d1a5d5202510208699a917ea6bcb6a4a8867b5d0e3a82d275eead75f3ccdd7d419bc9d104e23828796e3478be100caab845546542c62c26bc38f14dbbc3b17887aead0622e6b449c5088362f1c101f4660cd6821aad8b

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
872 B 233ms
232ms Ping
text/plain 23.206.172.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWZkMThhNTg2MA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.172.82 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-206-172-82.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.ducks.org/

Response headers

x-cache-remote: TCP_MISS from a104-96-220-39.deploy.akamaitechnologies.com (AkamaiGHost/11.6.5-0c617a4be13e71cac2c90d10d87ecf54) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Wed, 02 Oct 2024 16:30:07 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=27, origin; dur=51, inner; dur=46
x-cache: TCP_MISS from a23-58-89-47.deploy.akamaitechnologies.com (AkamaiGHost/11.6.4-e26983a004e229b4ffa935b6e3b2fe8f) (-)
date: Wed, 02 Oct 2024 16:30:07 GMT
x-akamai-request-id: 58d9e21.5f5edc9
access-control-allow-headers: Authorization,*
x-tt-trace-host: 0118f2588c390fdf206439d066ff65f42b236a42fcf90f619e3fa27932eaedea0075d8a41d3417e5ee1df85c7e9c5af3a2ea658432ee91d07e5f5e992c00aae16c5d70ba06d7b95467e83f0676c26256e0a1eb05b1698fb459180d05e1369380e7aa186f334e9309ac1c496e84d48eb065
x-origin-response-time: 51,104.96.220.39
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-2410021630072AA969A91208DE45DF8B-3279EB4F1BF9BCCF-00
content-length: 0
x-parent-response-time: 71,23.58.89.47
x-tt-logid: 202410021630072AA969A91208DE45DF8B
server: nginx

POST
H2 200 pixel
analytics.tiktok.com/api/v2/ 0
878 B 428ms
427ms Ping
text/plain 23.206.172.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWZkMThhNTg2MA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.172.82 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-206-172-82.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.ducks.org/

Response headers

x-cache-remote: TCP_MISS from a23-48-100-43.deploy.akamaitechnologies.com (AkamaiGHost/11.6.4-e26983a004e229b4ffa935b6e3b2fe8f) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Wed, 02 Oct 2024 16:30:07 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=167, origin; dur=27, inner; dur=23
x-cache: TCP_MISS from a23-58-89-47.deploy.akamaitechnologies.com (AkamaiGHost/11.6.4-e26983a004e229b4ffa935b6e3b2fe8f) (-)
date: Wed, 02 Oct 2024 16:30:07 GMT
x-akamai-request-id: 5355c158.5f5edca
access-control-allow-headers: Authorization,*
x-tt-trace-host: 0118f2588c390fdf206439d066ff65f42b3f0bb1732953e385d6946064f0e5ebc574a40731ef5dd35c6759aff8b129d3873e821092a2cbb84d514f1781fe31661e3d337c27f484d110d6263f8d016502952dbb4e888b1d4cd60f044dfbb0ce201d8da44a2fda0a70455183a46a5c1ec873
x-origin-response-time: 27,23.48.100.43
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-24100216300794CDA9B69D8DEE43DB0B-22C41D8E35EB2EBB-00
content-length: 0
x-parent-response-time: 155,23.58.89.47
x-tt-logid: 2024100216300794CDA9B69D8DEE43DB0B
server: nginx

GET
DATA 200
OK truncated
/ Frame 4C0D 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d6f22defa3db5ea3d15421b1c84cfc8ca073bccdeefac5a4c332142dc03050a1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

POST
H2 200 act
analytics.tiktok.com/api/v2/pixel/ 0
873 B 179ms
177ms Ping
text/plain 23.206.172.82
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.tiktok.com/api/v2/pixel/act
Requested by: Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MWZkMThhNTg2MA.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.172.82 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-206-172-82.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://www.ducks.org/

Response headers

x-cache-remote: TCP_MISS from a104-112-235-85.deploy.akamaitechnologies.com (AkamaiGHost/11.6.5-0c617a4be13e71cac2c90d10d87ecf54) (-)
access-control-allow-methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS,UPDATE
expires: Wed, 02 Oct 2024 16:30:07 GMT
server-timing: cdn-cache; desc=MISS, edge; dur=20, origin; dur=24, inner; dur=19
x-cache: TCP_MISS from a23-58-89-47.deploy.akamaitechnologies.com (AkamaiGHost/11.6.4-e26983a004e229b4ffa935b6e3b2fe8f) (-)
date: Wed, 02 Oct 2024 16:30:07 GMT
x-akamai-request-id: 1e666ba.5f5ee83
access-control-allow-headers: Authorization,*
x-tt-trace-host: 0118f2588c390fdf206439d066ff65f42bf80f71ba93e5c251f8178a546a9408f04489857702f57f9bb0ebf2821875e187f0211da5a3211b9e3e1f32d607c390169a6eb0bb537539f782844714d1ded26de75308add5b9ec9387d7dc227c8c2f2ce85eb1c6c8c840a30b5c84002caf2bd0
x-origin-response-time: 24,104.112.235.85
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
access-control-allow-origin: *
x-tt-trace-id: 00-241002163007FC579A230729853D7A9B-0E236F987E142B75-00
content-length: 0
x-parent-response-time: 32,23.58.89.47
x-tt-logid: 20241002163007FC579A230729853D7A9B
server: nginx

GET 6e4978f1-2a30-4eb8-b7bb-9a38749e7efa
https://www.ducks.org/ Frame 0
0

GET
H3 200 ca6be1649b2c6bd5aa79ebaa229fa676.js Show response
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ 20 KB
8 KB 93ms
92ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/ca6be1649b2c6bd5aa79ebaa229fa676.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0113/4211.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 73322
cf-ray: 8cc613437ce25388-DEN
access-control-allow-origin: *
date: Wed, 02 Oct 2024 16:30:07 GMT
content-type: text/javascript
last-modified: Wed, 25 Sep 2024 18:34:31 GMT
vary: Accept-Encoding
server: cloudflare

GET
H3 200 65ff539103e871b8b1321dad37bcb0ea.js Show response
script.crazyegg.com/pages/versioned/tracking-scripts/ 95 KB
31 KB 94ms
92ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/tracking-scripts/65ff539103e871b8b1321dad37bcb0ea.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0113/4211.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 270ae4a1e48f8511fca03917a94c938b0833268f80d193690025cb9e91975f3c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: public, max-age=31536000, s-maxage=31536000
timing-allow-origin: *
content-encoding: gzip
cf-bgj: minify
cf-cache-status: HIT
age: 73320
cf-ray: 8cc613440dc65388-DEN
access-control-allow-origin: *
date: Wed, 02 Oct 2024 16:30:08 GMT
content-type: text/javascript
last-modified: Fri, 20 Sep 2024 21:52:44 GMT
vary: Accept-Encoding
server: cloudflare

GET
DATA 200
OK truncated
/ Frame FB50 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dd623238995df78d795dccff1de9ba4ea55760b5251dc252fe9325d34495338c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame FB50 0
0 460ms
198ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsslWoPf0YE4fUcsOcePqYsvy-WIvS6PbE6Tu_kWSaCXbVsUmeuEuc2WRQ95UJ__aLxSR7xvDBfwXuRCyuNB4IKN2aH-dYbVCbc8K0Cc-XZ1aXVVGvqWGfp_QpnTdVFWHnhOrazxh8YEDJzj9dt_tSM6u79rC_rQxennzVX3EtCpnVz-3-BgYi8X3Q6L0nLEmG4ALzy-wHG81F3LXVtRfp8m41NFQeO_lKadjVaVIMQL0I80rgWomH2TF8HW35PnBEIYyQC3S52JckNBtaHJlctXDgTTatMmwsWAGIMI3jgkcQKk-pmQ2X3LeWpheIgucEmAZaDC6iS10ly5cBK0sk6OdZsZDA88lmyV85TT2ObTRhy-5Rpl1lDfXik-uPyHITf2VmdiYxVO4FwtCg&sai=AMfl-YShTFxpBDxl-F4i1GW1NOJegB4tlpgzGkFnoftie9tJyAhI3BY6KfsPsmJIhwFKrTnCZ8teHJcZSe-V-WablBS3-zVXb6-q3VPDgwL51-TxWO-abqlDkcCpHxwm&sig=Cg0ArKJSzIgWPos8UbL2EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:30:08 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 02 Oct 2024 16:30:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3277 0
0 435ms
201ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssdB9bFgBtqUFCvBq8QmFR0vifcAds8cK_mioNHHTNYp968bFJqcBAwU4MI3awLNO_OZBDCRAmkomnrwGpLBbXmADRYTDsdOPC9NmyYVp753yw_n1J6MS28qZAJO1zSJXLbD_Zqp5maeFtBXV3O6OXnFXhZXO6G_2BGWa4anPW0hi7SpbkLgokrxtFLHOp6KhDyR-QdYZAftFO376qaGfo90b64snmQ9pv4Cz5-NVMlNUSuz_YXhIW4NH3pjtSNmfFapTqYLglvzfNDqMqnh4OR3mSs43tzvkxtI4DrAf8rPCPnlpQFZEwHtTrznNqskGYmEB75Tanyvqvw80U_dTf1mrUpswx_FBq0DCM65YO6R4N7lgcS5QT_FA&sai=AMfl-YTrNHiWDNyZ-M8Of9oK_f1KaNjnK4OTUQAgDN8b5xO1dWowOHVthaksQJ9f2AS6o8fXqpPv2ucz9--1rGxOBDKPSvvl_mJlrCWnffyDzv4KM6nwCty7mtuASb4&sig=Cg0ArKJSzIsnefxGucFEEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:30:08 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 02 Oct 2024 16:30:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4C0D 0
0 404ms
203ms Fetch
image/gif 142.251.40.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss9c7BFJkz6a7Y5aJWtcivvvXoFK7lbIGdSM-VcArJjgjItHJ8WocwulM43qZmuS1BwtOTd3KQ-NHROZDOJ_AZZlGXzn7CdjPDmw5kLh8KN6VvDDKPIgCDN5T3LM3uU7-iTb_gg3ldRFDI9vrHFMZy3SW5d57gkjHh6PPw2kW0eu-70t0GZoSJlANKlINUI2gDyxHKopofl8ACWlTSG3_nD-WgisryZRgsWQ_au34EhDkYZPoijkUHoltCDeZiYWD6C0PwXjaloBahwsdChFKkzCk0fJ3YxH6Ii3PsXiyJ3qPYNPdXMIHp2JHTNjhV74icxDgG2xBxYh8cProYusjeecc3jcETpO-2uPwr3gDTzZprtE-2YTXfrN2HhNA&sai=AMfl-YRBqjmiSGd4iIft_3sZwpVNs0Xk_kmhIrUYdps_BHYdQuiKemKr2MB0JRBHbnZyZc6V-n5nsKiBEIO0ReUGdb9aYw1e_5TpEAxExYc0vKRPg9_Nue8ftBE3UbWX&sig=Cg0ArKJSzIl3BKKdWbWuEAE&uach_m=%5BUACH%5D&adurl=

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: private
timing-allow-origin: *
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:30:08 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 02 Oct 2024 16:30:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FB50 0
0 456ms
193ms Fetch
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 02 Oct 2024 16:30:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3277 0
0 642ms
193ms Fetch
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 02 Oct 2024 16:30:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H2 204 / Show response
px.ads.linkedin.com/wa/ 0
194 B 181ms
179ms XHR
text/plain 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://px.ads.linkedin.com/wa/
Requested by: Host: www.ducks.org
URL: https://www.ducks.org/modules/CsrfServlet
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.ducks.org/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Accept: *
Content-Type: text/plain;charset=UTF-8

Response headers

linkedin-action: 1
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 5D282F1934A74FBAACACA9F299C78BA9 Ref B: PAOEDGE0617 Ref C: 2024-10-02T16:30:08Z
x-li-fabric: prod-lva1
access-control-allow-credentials: true
x-li-uuid: AAYjgPOAYKWLUh1C1EXCkw==
x-li-proto: http/2
access-control-allow-origin: https://www.ducks.org
x-cache: CONFIG_NOCACHE
date: Wed, 02 Oct 2024 16:30:07 GMT
vary: Origin

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C0D 0
0 828ms
192ms Fetch
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Wed, 02 Oct 2024 16:30:08 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 17 KB
13 KB 426ms
375ms XHR
application/json 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202409260101&st=env

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/modules/CsrfServlet

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

6dd7b3dcf25e1357e905dce8dd8f00aa558969bfb53fd6fd101afe12465cc2ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 12854
date: Wed, 02 Oct 2024 16:30:08 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 218 KB
78 KB 170ms
169ms Script
application/javascript 142.251.40.168
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=DC-5083104&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M2LTJJQ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.168 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s81-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

0b037ba12cc1229d24149d936b1ef963d783b0822d5961a2227b364eda0f5da4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires: Wed, 02 Oct 2024 16:30:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:08 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Wed, 02 Oct 2024 15:59:53 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80097
x-xss-protection: 0
server: Google Tag Manager

GET
H2

200

/
match.adsrvr.org/track/upb/ Frame B775
Redirect Chain

https://insight.adsrvr.org/track/up?adv=7mxs1ri&ref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&upid=ltldgpr&u...
https://match.adsrvr.org/track/upb/?adv=7mxs1ri&ref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&upid=ltldgpr&u...

0
0

106ms
103ms

Document
text/html

3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/upb/?adv=7mxs1ri&ref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&upid=ltldgpr&upv=1.1.0&paapi=1
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 02 Oct 2024 16:30:08 GMT
server: Kestrel
vary: Accept-Encoding

Redirect headers

content-length: 477
date: Wed, 02 Oct 2024 16:30:08 GMT
location: https://match.adsrvr.org/track/upb/?adv=7mxs1ri&ref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&upid=ltldgpr&upv=1.1.0&paapi=1
server: Kestrel

GET
H2 200 favicon-32.png
www.ducks.org/modules/du-templates/images/ 823 B
1 KB 253ms
252ms Other
image/png 13.35.93.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.ducks.org/modules/du-templates/images/favicon-32.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.35.93.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-35-93-104.jfk50.r.cloudfront.net

Software

openresty /

Resource Hash

dc559cfb7425831d237e62f1ffe7bbc5ff3cd13a77d5e5061f62ee937fa21045

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
cache-control: public, max-age=2678400, private
x-content-type-options: nosniff
via: 1.1 3ffc96c97d8be4bd38d62dce94cb1db0.cloudfront.net (CloudFront)
expires: Sat, 02 Nov 2024 03:00:08 GMT
x-resolver-ip: 18.235.143.165
x-cache: RefreshHit from cloudfront
content-length: 823
x-amz-cf-id: MSQ-bCyKPEvLb05NGks_UD0PtDMGw6fcYg_x-fDpyZD24YJxSi_ZDQ==
x-xss-protection: 1; mode=block;
date: Wed, 02 Oct 2024 16:30:08 GMT
content-type: image/png
last-modified: Thu, 26 Sep 2024 22:57:14 GMT
server: openresty
x-amz-cf-pop: JFK50-P8

GET
H3

200

activityi;dc_pre=CPz9n5yP8IgDFVgNdgYdmwAOHA;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=...
5083104.fls.doubleclick.net/ Frame 23DC
Redirect Chain

https://5083104.fls.doubleclick.net/activityi;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;ua...
https://5083104.fls.doubleclick.net/activityi;dc_pre=CPz9n5yP8IgDFVgNdgYdmwAOHA;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab...

0
0

209ms
209ms

Document
text/html

142.250.80.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5083104.fls.doubleclick.net/activityi;dc_pre=CPz9n5yP8IgDFVgNdgYdmwAOHA;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189022034z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-5083104&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.70 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 396
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:09 GMT
expires: Wed, 02 Oct 2024 16:30:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:08 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5083104.fls.doubleclick.net/activityi;dc_pre=CPz9n5yP8IgDFVgNdgYdmwAOHA;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189022034z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activityi;fledge=1;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=4...
td.doubleclick.net/td/fls/rul/ Frame AFFA 0
0 166ms
164ms Document
text/html 142.250.176.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://td.doubleclick.net/td/fls/rul/activityi;fledge=1;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189022034z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=DC-5083104&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:08 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activity;register_conversion=1;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi...
ad.doubleclick.net/ 0
22 B 194ms
193ms Image
image/png 172.217.165.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/activity;register_conversion=1;src=5083104;type=gener0;cat=gener0;ord=7706084248671;npa=0;auiddc=1417215480.1727886605;ps=1;pcor=1787592121;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;pscdl=noapi;frm=0;gtm=45fe4a10v9189022034z8810428079za201zb810428079;gcd=13l3l3l3l1l1;dma=0;tag_exp=101671035~101747727;epver=2;~oref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail?

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.165.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s70-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Wed, 02 Oct 2024 16:30:08 GMT
attribution-reporting-register-trigger: {"aggregatable_deduplication_keys":[{"deduplication_key":"9974385396403611889"}],"aggregatable_trigger_data":[{"filters":[{"14":["2716358"]}],"key_piece":"0x3e6c0c6794b4c376","source_keys":["12","13","14","15","16","17","18","19","20","21"]},{"key_piece":"0x1a88d8e822b8cd32","not_filters":{"14":["2716358"]},"source_keys":["12","13","14","15","16","17","18","19","20","21"]}],"aggregatable_values":{"12":65,"13":65,"14":65,"15":6356,"16":65,"17":65,"18":6356,"19":65,"20":65,"21":6356},"aggregation_coordinator_origin":"https://publickeyservice.msmt.aws.privacysandboxservices.com","debug_key":"3327350831718226118","debug_reporting":true,"event_trigger_data":[{"deduplication_key":"9974385396403611889","filters":[{"14":["2716358"],"source_type":["event"]}],"priority":"10","trigger_data":"1"},{"deduplication_key":"9974385396403611889","filters":[{"14":["2716358"],"source_type":["navigation"]}],"priority":"10","trigger_data":"6"},{"deduplication_key":"9974385396403611889","filters":[{"source_type":["event"]}],"priority":"0","trigger_data":"0"},{"deduplication_key":"9974385396403611889","filters":[{"source_type":["navigation"]}],"priority":"0","trigger_data":"7"}],"filters":{"8":["5083104"]}}
content-type: image/png
x-xss-protection: 0
server: cafe

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 18 KB
7 KB 170ms
169ms Script
text/javascript 142.250.65.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202409260101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.225 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f1.1e100.net

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:30:08 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:08 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

GET
H2 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/232/ Frame B979 0
0 117ms
117ms Document
text/html 142.250.65.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/232/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.225 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s73-in-f1.1e100.net

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 952
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:14:17 GMT
expires: Wed, 02 Oct 2024 17:04:17 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe
www.google.com/recaptcha/api2/ Frame 18D9 0
0 161ms
160ms Document
text/html 142.250.80.68
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.80.68 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s35-in-f4.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-heW9dgFRzMFjVA5Ok3D2cA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.ducks.org/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-heW9dgFRzMFjVA5Ok3D2cA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Wed, 02 Oct 2024 16:30:09 GMT
expires: Wed, 02 Oct 2024 16:30:09 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3277 42 B
65 B 195ms
194ms Fetch
image/gif 142.250.65.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssZXbJHXh_aKoRJloTln88wpHJtlCPtRsbsmGReQVOC88Kb8vfkBXH-sDGL2CBBieE6jrWHxPFSNb46WQzKpZwUpM1mkP_ImHo1_ntnLMb1BHjHO4rt3JGknHKHSEpYzSZBpDZNKGUj_YJT1UsqGXUARRqtxM9nBcHiarukE6Tsn0izRbZByfK1fihJGey_agkSiw&sig=Cg0ArKJSzKpzN8y2RFGDEAE&id=lidar2&mcvt=1000&p=728,436,818,1164&tm=1041.6999998092651&tu=41.5&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240930&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3507658625&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=2381940800&rst=1727886607425&rpt=770&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.65.162 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s71-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Wed, 02 Oct 2024 16:30:09 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET sodar
pagead2.googlesyndication.com/pagead/ 0
0

GET
H3 200 ad Show response
ads.adventive.com/ Frame FB50 182 KB
35 KB 338ms
213ms Script
text/javascript 104.16.224.232

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.adventive.com/ad?j&pid=0da2dca6-608d-425b-95aa-9f4be7d1daed&type=4&cb=319968973&click=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsv2qcGxU7wgiLHcYJrXqXImhd-5OZVdqxQjn-W3nm3Xl4cnd_Tn9g10u3bXmozpY2jy9akNA14c6uqKHrNC9GYJcvxS7RWJxrlD5DVrCqpBSEZ05fjnxwKcuvqxT7mfQQcVlp18PvNCsEJYEr0GUFGPgcnOWerqzF1XDcC6oyHHIsXfa6uiVUSlKDgpAQdxo8Af4aU9WdRQ0KonekV2mG3zKOEnEUFAFywSCDdRgyoZGO6N3BN3Pqrnh69qSYQn5TF7_7KQ6BK_pZnHfIVfy5Xqj4t2k5UHtgmSmFu4Xs1dL4VTctfh3ZVkDj7jBiQBUogTBoCvLFqQmZYs3rTPmWlAh99ElYzd5mRa0jtBvxLScHfEf8-cbcFE7INnIw%2526sai%253DAMfl-YQfVMYRB-LmnZeBXkcTc_fCC0CcG4BMdvc793iQSeL51MJ1Lxhv-hZ_ZHs_GNW6KfujntdO33B98MmNkwyMU0qCXxCR3JzN1UOCXmLa9Bfo9v6OLT3uShd_0lTA%2526sig%253DCg0ArKJSzJsTzJ72wgYoEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D&enc=1&gdpr=&gdpr_consent=&fb_url=&ref=ducks.org&oop=

Requested by

Host: www.ducks.org
URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.224.232 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

46d130e479753926c2b523dd664d69a1808bbbe4cf45e64c8343b67d5f5347a2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
expires: Sat, 26 Jul 1997 05:00:00 GMT
x-ua-compatible: IE=edge
date: Wed, 02 Oct 2024 16:30:12 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Wed, 02 Oct 2024 16:30:12 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
timing-allow-origin: *
pragma: no-cache
cf-ray: 8cc613611a756b50-DFW
access-control-allow-origin: *
content-length: 35494
cf-apo-via: origin,host
server: cloudflare

GET
H3 200 ad Show response
ads.adventive.com/ 181 KB
35 KB 209ms
209ms Script
text/javascript 104.16.224.232

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: ads.adventive.com
URL: https://ads.adventive.com/ad?j&pid=0da2dca6-608d-425b-95aa-9f4be7d1daed&type=4&cb=319968973&click=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsv2qcGxU7wgiLHcYJrXqXImhd-5OZVdqxQjn-W3nm3Xl4cnd_Tn9g10u3bXmozpY2jy9akNA14c6uqKHrNC9GYJcvxS7RWJxrlD5DVrCqpBSEZ05fjnxwKcuvqxT7mfQQcVlp18PvNCsEJYEr0GUFGPgcnOWerqzF1XDcC6oyHHIsXfa6uiVUSlKDgpAQdxo8Af4aU9WdRQ0KonekV2mG3zKOEnEUFAFywSCDdRgyoZGO6N3BN3Pqrnh69qSYQn5TF7_7KQ6BK_pZnHfIVfy5Xqj4t2k5UHtgmSmFu4Xs1dL4VTctfh3ZVkDj7jBiQBUogTBoCvLFqQmZYs3rTPmWlAh99ElYzd5mRa0jtBvxLScHfEf8-cbcFE7INnIw%2526sai%253DAMfl-YQfVMYRB-LmnZeBXkcTc_fCC0CcG4BMdvc793iQSeL51MJ1Lxhv-hZ_ZHs_GNW6KfujntdO33B98MmNkwyMU0qCXxCR3JzN1UOCXmLa9Bfo9v6OLT3uShd_0lTA%2526sig%253DCg0ArKJSzJsTzJ72wgYoEAE%2526fbs_aeid%253D%25255Bgw_fbsaeid%25255D%2526urlfix%253D1%2526adurl%253D&enc=1&gdpr=&gdpr_consent=&fb_url=&ref=ducks.org&oop=

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.224.232 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

dbb470a6629c19bf4af9a9f7b5760788ce91530a5c604e6b7d27ba3def0b9826

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
expires: Sat, 26 Jul 1997 05:00:00 GMT
x-ua-compatible: IE=edge
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: text/javascript;charset=UTF-8
last-modified: Wed, 02 Oct 2024 16:30:13 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
timing-allow-origin: *
pragma: no-cache
cf-ray: 8cc61363ae036b50-DFW
access-control-allow-origin: *
content-length: 35240
cf-apo-via: origin,host
server: cloudflare

GET
H3 200 stats
ads.adventive.com/api/ Frame FB50 43 B
363 B 180ms
179ms Image
image/gif 104.16.224.232

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.adventive.com/api/stats?acc=514&adv=14691&atid=4&auid=181922&cache=1&cid=76443&gid=0&pcid=106511&pid=202866&sid=1250&tag=0da2dca6-608d-425b-95aa-9f4be7d1daed&tz=America%2FNew_York&up=0.00000&ut=RM&vid=2&ckid=deab917a-f6a8-465d-bbf1-bea6be07d9a7&ip=45.13.235.50&clk=0&dat=%7B%7D&dh=1200&dw=1600&eng=0&gdpr=&gdpr_consent=&grp=0&hc=kesquisg&iid=40702743ff35433b96843d7dfd2fcd6e&ref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&type=serve_impression&hov=0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.16.224.232 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: none
cf-cache-status: DYNAMIC
expires: Thu, 03 Oct 2024 16:30:13 GMT
p3p: CP="CAO PSA OUR"
x-ua-compatible: IE=edge
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: image/gif
vary: Accept-Encoding
cache-control: private, max-age=86400, must-revalidate
timing-allow-origin: *
pragma: cache
cf-ray: 8cc61363ae066b50-DFW
access-control-allow-origin: *
content-length: 43
cf-apo-via: origin,host
server: cloudflare

GET
H3 200 vissense.min.js Show response
cdnjs.cloudflare.com/ajax/libs/vissense/0.10.0/ 11 KB
4 KB 175ms
90ms Script
application/javascript 104.17.25.14

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/vissense/0.10.0/vissense.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

c34e28196cd412790c548696f1447aff0116ee662fead57bf578021e8cc01ba5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb04028-2af5"
age: 429926
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=loZixz3lre1KhC3%2FKl%2FZGTgCL%2FCPUrfwwEXJFv0X0vV%2F1UPp54fUhHmIzsW6fWj6Dz6WhO8X1AzGsMbvipdPw1KxzyVT1OPbEtXqq7OIDTOQooUEkCoWvma%2BB07fnHDQQiZYVkNM"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Mon, 22 Sep 2025 16:30:13 GMT
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:17:44 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cc613662ded79a1-DEN
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3066
server: cloudflare

GET
H2 200 interstitial-close.svg
assets.adventivecdn.com/ui/images/ 3 KB
1 KB 291ms
106ms Image
image/svg+xml 104.18.5.174

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.adventivecdn.com/ui/images/interstitial-close.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.5.174 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 4a519d2bd3043b930e0bbc73d78b2c4d672981401a8de9e846831502365c4509

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cache-control: max-age=43200
content-encoding: br
cf-cache-status: HIT
etag: W/"63fb9f6703706b219d1cd65c1d88c1d3"
age: 69755
x-amz-request-id: AZ06JK3SZ2Y5F8ZV
cf-ray: 8cc61366ea857c28-DEN
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: image/svg+xml
last-modified: Wed, 06 Nov 2019 15:50:45 GMT
vary: Accept-Encoding
server: cloudflare
x-amz-id-2: 6wX3HgRaH+PvZpu2us5MbZg+VOAE46y7kZZ7z2WanEjSyl/Xaaj3IFuSix/IAgB0tiBm3ZPNK2s=

GET
H2 200 c55a62f5-7d86-41c8-a1e7-aaad3e4d29a0
assets.adventivecdn.com/cdn-cgi/image/f=auto,q=90,w=130/514/ Frame A2E8 3 KB
4 KB 277ms
108ms Image
image/avif 104.18.5.174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.adventivecdn.com/cdn-cgi/image/f=auto,q=90,w=130/514/c55a62f5-7d86-41c8-a1e7-aaad3e4d29a0

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.5.174 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2eaff8c52f46fc588f2d14b084713299f44ca9c84fba1fbc21801f996f31fbc8

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: max-age=43200
cf-cache-status: HIT
etag: "cffVSIyF5poGj1xfWL0C0Fo3Eh_O6Naumo503LmIpvDQ:40ec1ba7d405ce13aa0a48f7dd1bdd56"
cf-bgj: imgq:90,h2pri
cf-resized: internal=ok/h q=0 n=31+70 c=2+68 v=2024.9.3 l=3576 f=false
x-content-type-options: nosniff
cf-ray: 8cc61366ea7b7c28-DEN
accept-ranges: bytes
content-length: 3576
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: image/avif
last-modified: Tue, 01 Oct 2024 19:15:24 GMT
vary: Accept, Accept-Encoding
server: cloudflare

GET
H2 200 0f2daa65-cfa8-40b7-9613-a1060a3368ff
assets.adventivecdn.com/cdn-cgi/image/f=auto,q=90,w=387/514/ Frame A2E8 24 KB
24 KB 311ms
144ms Image
image/avif 104.18.5.174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.adventivecdn.com/cdn-cgi/image/f=auto,q=90,w=387/514/0f2daa65-cfa8-40b7-9613-a1060a3368ff

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.5.174 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

d75d52f2f718f9592de9ac6bf277224085633fcf4b05f476ce307743ca298855

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: max-age=43200
cf-cache-status: HIT
etag: "cfvQSw4bMaMHgQFjjrP5MTSSeMzH_aT7ZPbrvWoDSMDQ:bbb402a569d85cd000b60e2abdb740f1"
cf-bgj: imgq:90,h2pri
cf-resized: internal=ram/m q=0 n=0+96 c=0+0 v=2024.9.3 l=24420 f=false
x-content-type-options: nosniff
cf-ray: 8cc61366ea817c28-DEN
accept-ranges: bytes
content-length: 24420
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: image/avif
last-modified: Tue, 24 Sep 2024 16:11:02 GMT
vary: Accept, Accept-Encoding
server: cloudflare

GET
H2 200 c6fb95f5-669f-4f42-82cf-29f61f7d114f
assets.adventivecdn.com/cdn-cgi/image/f=auto,q=90,w=93/514/ Frame A2E8 2 KB
2 KB 373ms
211ms Image
image/avif 104.18.5.174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.adventivecdn.com/cdn-cgi/image/f=auto,q=90,w=93/514/c6fb95f5-669f-4f42-82cf-29f61f7d114f

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.5.174 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

964c0b64086012adfb77a29e441e55810429957ab059bb3806b144cb6f5a91b6

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: max-age=43200
cf-cache-status: HIT
etag: "cfzlTgVsGlGr04ciY3a46pFwT7iZiQYP5OzMs8W8j8DQ:91872a942128436f0d25ed0b645e1f2d"
cf-bgj: imgq:90,h2pri
cf-resized: internal=ram/m q=0 n=0+27 c=2+25 v=2024.9.3 l=1639 f=false
x-content-type-options: nosniff
cf-ray: 8cc61366ea837c28-DEN
accept-ranges: bytes
content-length: 1639
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: image/avif
last-modified: Tue, 24 Sep 2024 16:11:03 GMT
vary: Accept, Accept-Encoding
server: cloudflare

GET
H2 200 css
fonts.googleapis.com/ Frame A2E8 2 KB
668 B 152ms
149ms Stylesheet
text/css 142.251.35.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:300,300&display=swap

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.170 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f10.1e100.net

Software

ESF /

Resource Hash

9992412bb27e6f7246168320dd4efece61b87f8cdc3cb10bb568c5f5ebc4afa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:30:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 02 Oct 2024 16:30:13 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ Frame A2E8 2 KB
622 B 153ms
151ms Stylesheet
text/css 142.251.35.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:400,400&display=swap

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.170 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f10.1e100.net

Software

ESF /

Resource Hash

1e37b616b4dfba2c95070068b1f9811becb1f042c5eb0199ed38dcfd1f0960cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 02 Oct 2024 16:30:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: text/css; charset=utf-8
last-modified: Wed, 02 Oct 2024 16:30:13 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 3602cf26-e07c-49fb-91f1-2b9fa946189b
assets.adventivecdn.com/cdn-cgi/image/f=auto,q=90,w=800/514/ Frame A2E8 1 KB
2 KB 276ms
116ms Image
image/avif 104.18.5.174

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.adventivecdn.com/cdn-cgi/image/f=auto,q=90,w=800/514/3602cf26-e07c-49fb-91f1-2b9fa946189b

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.5.174 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

f55f223dadd14e54057b85eaaa1ee624e7fbbf0d5221174c8ff85f7bdd9de67b

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; navigate-to 'none'; form-action 'none'
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

content-security-policy: default-src 'none'; navigate-to 'none'; form-action 'none'
cache-control: max-age=43200
cf-cache-status: HIT
etag: "cfEc8r-3SzOG16_GmKmyd3BYRsd10g3p3uCYITy_FuDQ:2e87503ae07b246789c9c2194426723c"
cf-bgj: imgq:90,h2pri
cf-resized: internal=ok/h q=0 n=36+389 c=0+0 v=2024.9.3 l=1179 f=false
x-content-type-options: nosniff
cf-ray: 8cc61366ea7e7c28-DEN
accept-ranges: bytes
content-length: 1179
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: image/avif
last-modified: Thu, 01 Sep 2022 13:28:22 GMT
vary: Accept, Accept-Encoding
server: cloudflare

GET
H2 200 blank.png
assets.adventivecdn.com/ui/images/ Frame A2E8 68 B
622 B 264ms
105ms Image
image/png 104.18.5.174

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.adventivecdn.com/ui/images/blank.png
Requested by: Host: srcdoc
URL: about:srcdoc
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.5.174 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: f309b7c03d9cae63a9bedbee6ed655f3dbcdb194132943639344dead5f3b9710

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://www.ducks.org/

Response headers

cf-bgj: imgq:100,h2pri
etag: "e679fbd466a2d656f194a5da4fa083cd"
age: 71803
cf-cache-status: HIT
cf-polished: status=not_needed
date: Wed, 02 Oct 2024 16:30:13 GMT
content-type: image/png
last-modified: Wed, 24 Jul 2019 17:44:25 GMT
vary: Accept-Encoding
x-amz-id-2: FQPa5U4BYnMxHzHlSkxzKLrm6ox4xnKylGLhSXTpvRyRT5Yj7WhwGGjpLWCzw9+LYEvtHK7X4PE=
cache-control: max-age=43200
x-amz-request-id: A04W3JXG4Q15JTFT
cf-ray: 8cc61366ea7f7c28-DEN
accept-ranges: bytes
content-length: 68
server: cloudflare

GET
H3 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCs16Hw5aXo.woff2
fonts.gstatic.com/s/montserrat/v26/ Frame A2E8 15 KB
15 KB 135ms
135ms Font
font/woff2 142.251.40.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCs16Hw5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:300,300&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.227 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f3.1e100.net

Software

sffe /

Resource Hash

5a117249cdc1f7687bab98dc2cacdebd9a56553cf2c87ca8d41245cd12a3321a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.ducks.org
Referer: https://fonts.googleapis.com/

Response headers

age: 13885
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 12:38:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 12:38:48 GMT
last-modified: Wed, 13 Sep 2023 22:44:39 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14964
x-xss-protection: 0
server: sffe

GET
H3 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2
fonts.gstatic.com/s/montserrat/v26/ Frame A2E8 15 KB
15 KB 133ms
132ms Font
font/woff2 142.251.40.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,400&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.227 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s39-in-f3.1e100.net

Software

sffe /

Resource Hash

4b5816bbfc52587979139951355fe4048da02ce60e40cef8e4a1efb6cd396281

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://www.ducks.org
Referer: https://fonts.googleapis.com/

Response headers

age: 28384
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 02 Oct 2025 08:37:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 02 Oct 2024 08:37:09 GMT
last-modified: Wed, 13 Sep 2023 22:46:07 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 14940
x-xss-protection: 0
server: sffe

GET stats
ads.adventive.com/api/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: jelly-v6.mdhv.io
URL: https://jelly-v6.mdhv.io/v1/starV6.gif?evt=hi&pid=VeyTa07IwUHIJHbvty1l6y9yE8BK&src=mh&tx=59ee2c00-8f66-42b8-86fd-8ec2a27f5492

Domain: www.ducks.org
URL: blob:https://www.ducks.org/54dee2d3-a3d8-4256-9f3b-20b1475df56b

Domain: www.google.com
URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRFiNAXY419RcMTDBBTQjWoYL1aEMI97SVVttcgLpTwBWCSx7jY6fO2k0XzWkd7ueGpqRoT

Domain: www.google.com
URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSt1f9znTUTKQLxl6V8b0GSaMYqSoIpNUKwxzzIVVOTz73Stkat1uJqvriQMbbV16aeH9-P

Domain: www.ducks.org
URL: blob:https://www.ducks.org/6e4978f1-2a30-4eb8-b7bb-9a38749e7efa

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=232&t=2&li=gpt_m202409260101&jk=2019486453104884&bg=!ra6lruHNAAbzZSz302U7ADQBe5WfOEA0gdtyHi2pZXy_E6dpn8sx2OgwTyqrJKHx4nL-dkqAxnRlNTXLz7wwcTdLh7cPAgAAAElSAAAAA2gBB34ANhn83rDTLhnNZbQNbFSfXHyvoxIe66-n4LZ9-UyQ-CFouf8fMlZNhpqjklUnIgaAIjAyhjzpTJkCmOgcJMlmiaFIQqOM5sh8383bbEQtKSBaVwbDFSGA1A1mJWQNpFmcG5kjGevSsAxlz-Qmkwuu0nFRKbLA39uMBr9dWO-_HKfpOjEClAmJQ9JjCKc_RY7vNIhq42KX71ucxH7A03K2Dru5yXbVS-tocyJj9Tq-v35bpOWeC4IZm6wOEhm9qtMXyWD8Ug6Y0KAtEAzCGuRPy5-ZjBmOCn6S7ntWjmGDCndyHBccD30cMUiQRkHkZsuFuj_gQcaIwzwUC8ze9Rag-sIrjzUqtM5Cn-3kceA4PwMFs5I5580LTPWNfMVVlH4B9rF4dzkzHzNt5jTNAfCCN2_HovW2TG7fSFypcP7908glu_pZoiUSuWxnlmpsd4nrmo-j9HS0-_FtMwT1NPzn4QgYKIaojmpRprJ8xPXUJtZTmulZgzPwRnre1vC59FeQPo-5nkpA4B_MlFHknXRh7bEBUd6nYRcqMxW7O6wHKiuA_jWrXJbfLKga8kfPLC1XmrvDMd72PEjP8zYCkWShpX6PqNEo3Xk97DNMWsC5687PvBIlJ9_mIoOwGgzDLymS_rMsxIiWEuah9UlbrBgoPm9dI_VG_VieSzQOcPwG8cZP8BTu8DY-1u6EqfpsDch2bXAAoPmZmagPW8dSa8IV6ITBt7b9546118EVI84PzpPGgGuiNiZz_wvseQmWiKNQQq3vjj9a0yE6m2F7fANuEAXObIYvUmCQ7wzY2sepUjX9Hy7AocxLucHxOr9e4djg_y0zE6X4VD2S8UVlITT7v0d3JPAxG45ExzJRv-U8q8OvKdHEFJrVP0w2pcYzOjvV0nsU5dGS3UChtbOVyLokoeyiyUQcMYs-S_3pX24oTnm5tUmPmDdlaMCY5Tgsmt0Hnxc

Domain: ads.adventive.com
URL: https://ads.adventive.com/api/stats?acc=514&adv=14691&atid=4&auid=181922&cache=1&cid=76443&gid=0&pcid=106511&pid=202866&sid=1250&tag=0da2dca6-608d-425b-95aa-9f4be7d1daed&tz=America%2FNew_York&up=0.00000&ut=RM&vid=2&ckid=deab917a-f6a8-465d-bbf1-bea6be07d9a7&ip=45.13.235.50&clk=0&dat=%7B%22viewTime%22%3A1%2C%22screenIndex%22%3A1%7D&dh=1200&dw=1600&eng=0&gdpr=&gdpr_consent=&grp=0&hc=mqigwyck&iid=f9672f0c9a51444faac750219581f17d&ref=https%3A%2F%2Fwww.ducks.org%2Fhunting%3Futm_campaign%3D20241002_newsletter_dunews_dunewsoct%26utm_source%3DCI%26utm_medium%3Demail&type=ad_view_view_auto&hov=0&cb=1727886614570

Verdicts & Comments Add Verdict or Comment

121 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

54 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
portalc.criticalimpact.com/	1969-12-31 23:59:59	Name: JSESSIONIDTC1 Value: C12B77A13037424294351A88D952CDBF
portalc.criticalimpact.com/	1970-01-21 00:27:00	Name: cfid Value: 34deda42-71aa-49bf-bf6a-f4124eff008f
portalc.criticalimpact.com/	1970-01-21 00:27:00	Name: cftoken Value: 0
portalc.criticalimpact.com/	1970-01-21 02:07:42	Name: CF_CLIENT_TPORTALCCRITICALIMPACTCOM_LV Value: 1727886603947
portalc.criticalimpact.com/	1970-01-21 02:07:42	Name: CF_CLIENT_TPORTALCCRITICALIMPACTCOM_TC Value: 1727886603947
portalc.criticalimpact.com/	1970-01-21 02:07:42	Name: CF_CLIENT_TPORTALCCRITICALIMPACTCOM_HC Value: 2
www.ducks.org/	1969-12-31 23:59:59	Name: slb_route Value: f45d9f5ed67442ebf9334e2385e62b5d
www.ducks.org/	1969-12-31 23:59:59	Name: wem-session-id Value: 79db8aca-cb39-4b72-94c5-449a9b0d66ac
www.ducks.org/	1969-12-31 23:59:59	Name: DISTRIBUTED_JSESSIONID Value: 7a352512-ccaa-40cf-8cf9-ff21f44bdae9.browsing.15722
www.ducks.org/	1969-12-31 23:59:59	Name: SERVERID Value: s15722
.ducks.org/	1970-01-21 02:07:42	Name: _gcl_au Value: 1.1.1417215480.1727886605
www.ducks.org/	1970-01-21 08:43:42	Name: __spdt Value: fea0ccb46a0842368c3859714515119d
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: 5DBFAHz6sBo
.youtube.com/	1970-01-21 04:17:18	Name: VISITOR_INFO1_LIVE Value: QoBC_vKDVsg
.youtube.com/	1970-01-21 04:17:18	Name: VISITOR_PRIVACY_METADATA Value: CgJVUxIEGgAgMQ%3D%3D
.tiktok.com/	1970-01-21 09:19:42	Name: _ttp Value: 2mtChlZX4NOklLUSPgd1dj5R22C
.ducks.org/	1970-01-21 09:34:06	Name: _ga_2X0ECQZQ09 Value: GS1.1.1727886606.1.0.1727886606.60.0.0
.ducks.org/	1970-01-21 09:34:06	Name: _ga Value: GA1.1.1482221127.1727886607
.ducks.org/	1970-01-21 02:07:42	Name: _rdt_uuid Value: 1727886606918.536cd42a-8e7c-40a8-8dc0-a76bd9a76188
.doubleclick.net/	1970-01-21 09:34:06	Name: IDE Value: AHWqTUm3U7J7RUIzCptB_w194yTg2YfXs6Vs4hqh6mgqbjGpitv8nKfQBwUP6uGi
.ducks.org/	1970-01-21 09:34:06	Name: _rollupGa Value: GA1.2.1482221127.1727886607
.ducks.org/	1970-01-20 23:59:33	Name: _rollupGa_gid Value: GA1.2.510519229.1727886607
www.ducks.org/	1969-12-31 23:59:59	Name: wem-profile-id Value: 893b2a1a-2240-419a-a76a-0fe86798823a
.ducks.org/	1970-01-21 02:07:42	Name: _fbp Value: fb.1.1727886607266.990395399544870660
.ducks.org/	1970-01-20 23:59:33	Name: _uetsid Value: 95e47be080db11ef8c25f1ddcdf9552d
.ducks.org/	1970-01-21 09:19:42	Name: _uetvid Value: 95e4abd080db11ef9fb00df1e4b707d0
.ducks.org/	1970-01-20 23:58:06	Name: _gat_DURollup Value: 1
.ducks.org/	1969-12-31 23:59:59	Name: cebs Value: 1
.ducks.org/	1970-01-20 23:59:33	Name: _ce.clock_event Value: 1
.bing.com/	1970-01-21 09:19:42	Name: MUID Value: 1CE2462ACF58651D1A6C5326CE066431
.bat.bing.com/	1970-01-21 00:08:11	Name: MR Value: 0
.doubleclick.net/	1970-01-21 00:41:18	Name: ar_debug Value: 1
.ducks.org/	1970-01-21 09:19:42	Name: __gads Value: ID=8523a7351abc6b42:T=1727886607:RT=1727886607:S=ALNI_MbwjVSjtraGEhMAhh0CIAFIlwopsg
.ducks.org/	1970-01-21 09:19:42	Name: __gpi Value: UID=00000f0e62fd1e03:T=1727886607:RT=1727886607:S=ALNI_MYn5edzeCa500ncKRldbbCg_aXHRg
.ducks.org/	1970-01-21 04:17:18	Name: __eoi Value: ID=ddff6795fc81bb25:T=1727886607:RT=1727886607:S=AA-AfjZkRgmP__krsmI60plqZCfI
.ducks.org/	1970-01-21 09:19:42	Name: _tt_enable_cookie Value: 1
.ducks.org/	1970-01-21 09:19:42	Name: _ttp Value: EUrxXE9OR1ehICfwKA_Ngxyw8H1
.linkedin.com/	1970-01-21 02:07:42	Name: li_sugr Value: 70b81998-3edb-44ad-ae92-1da8a5f5f73a
.linkedin.com/	1970-01-21 08:43:42	Name: bcookie Value: "v=2&694aa7c8-800e-4301-8998-805c09268fd7"
.linkedin.com/	1970-01-20 23:59:33	Name: lidc Value: "b=VGST02:s=V:r=V:a=V:p=V:g=3346:u=1:x=1:i=1727886607:t=1727973007:v=2:sig=AQHzRQAU7ZWil0tGVh-0rbj6d-Bk1EvD"
.doubleclick.net/	1970-01-21 04:17:18	Name: receive-cookie-deprecation Value: 1
.ducks.org/	1970-01-20 23:59:33	Name: _ce.clock_data Value: 66%2C45.13.235.50%2C1%2Ccd70ceeb4a1768030b1882c90242a428%2CChrome%2CUS
.linkedin.com/	1970-01-21 00:41:18	Name: UserMatchHistory Value: AQKK-4wrHx5_7AAAAZJOEUVyHNkFR8E9y6IZ6iiXFEU_eIvj6PfYBCW4juzQifKSD5zwSNoeRxdiaQ
.linkedin.com/	1970-01-21 00:41:18	Name: AnalyticsSyncHistory Value: AQKcpQAfnisZ2wAAAZJOEUVy0lRlWt5VD3J4kbbMWfElpRV0Y3TfZKrKao3hk6Bal4HReSReTB3GNumn2Qm2aQ
.ducks.org/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.ducks.org/	1970-01-21 08:43:42	Name: _ce.s Value: v~ceb18cb751e4ba076d8bd015520c15a44d823fc3~lcw~1727886607872~vir~new~lva~1727886607370~vpv~0~v11.fhb~1727886607859~v11.lhb~1727886607867~v11.cs~405056~v11.s~963fa000-80db-11ef-9975-49157f7b4057~lcw~1727886607874
.www.linkedin.com/	1970-01-21 08:43:42	Name: bscookie Value: "v=1&202410021630074f1a793a-4b4a-48e7-8303-9f26e08ed558AQEpgXr4598m7QcNF_vmk8SYrx4BOV97"
.adnxs.com/	1970-01-21 09:34:06	Name: receive-cookie-deprecation Value: 1
.adsrvr.org/	1970-01-21 08:43:42	Name: TDID Value: b9f44112-fdf3-4ea1-a739-90d4d674812d
.rubiconproject.com/	1970-01-21 08:43:42	Name: audit_p Value: 1\|iQvmCWaVGiSet3PDZKqgjWK3pt8TSzBq0TWkoiMQbl/gcoYKcsXyyldXfWEHvoxDrLMWDbPX4QKM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLtBp0RVAVfLqLQ+8T4sxFzkFMaoDBRa95iTKn/ECkkuhozNlnRkU3mkjgh0ef9QhZZbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.rubiconproject.com/	1970-01-21 08:43:42	Name: khaos Value: M1S32OU1-1P-KKMC
.rubiconproject.com/	1970-01-21 08:43:42	Name: khaos_p Value: M1S32OU1-1P-KKMC
.rubiconproject.com/	1970-01-21 08:43:42	Name: audit Value: 1\|iQvmCWaVGiSet3PDZKqgjWK3pt8TSzBq0TWkoiMQbl/gcoYKcsXyyldXfWEHvoxDrLMWDbPX4QKM1KxoLazIt9i2Wk5FrGos0XY24Ec+XLtBp0RVAVfLqLQ+8T4sxFzkFMaoDBRa95iTKn/ECkkuhozNlnRkU3mkjgh0ef9QhZZbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.adsrvr.org/	1970-01-21 08:43:42	Name: TDCPM Value: CAESFQoGZ29vZ2xlEgsI1orWvbDCsT0QBRIWCgdydWJpY29uEgsIuq6FtbDCsT0QBRIXCghhcHBuZXh1cxILCOLYhbWwwrE9EAUYBSACKAMyCwjU5ofixsKxPRAFQg8iDQgBEgkKBXRpZXIxEAFaBzdteHMxcmlgAQ..

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.ducks.org/hunting?utm_campaign=20241002_newsletter_dunews_dunewsoct&utm_source=CI&utm_medium=email(Line 1008) Message: Unrecognized feature: 'web-share'.
network	error	URL: https://jelly-v6.mdhv.io/v1/starV6.gif?evt=hi&pid=VeyTa07IwUHIJHbvty1l6y9yE8BK&src=mh&tx=59ee2c00-8f66-42b8-86fd-8ec2a27f5492 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10231870.fls.doubleclick.net
5083104.fls.doubleclick.net
ad.doubleclick.net
ads.adventive.com
alb.reddit.com
analytics.google.com
analytics.tiktok.com
assets-tracking.crazyegg.com
assets.adventivecdn.com
bat.bing.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
connect.facebook.net
d5db279c1ba4d37ac2ec9a5e42ed6173.safeframe.googlesyndication.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
insight.adsrvr.org
jelly-v6.mdhv.io
js.adsrvr.org
maps.googleapis.com
match.adsrvr.org
my.hellobar.com
pagead2.googlesyndication.com
pagestates-tracking.crazyegg.com
pixel-config.reddit.com
pixel.byspotify.com
pixels.spotify.com
portalc.criticalimpact.com
px.ads.linkedin.com
script.crazyegg.com
securepubads.g.doubleclick.net
share.transistor.fm
snap.licdn.com
stats.g.doubleclick.net
td.doubleclick.net
tpc.googlesyndication.com
tracking.crazyegg.com
unomiproduction-ducks.cloud.jahia.com
www.ducks.org
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.youtube.com
ads.adventive.com
jelly-v6.mdhv.io
pagead2.googlesyndication.com
www.ducks.org
www.google.com
104.16.224.232
104.17.25.14
104.18.5.174
104.19.147.8
104.22.14.23
108.139.33.128
13.107.42.14
13.35.93.104
13.35.93.8
142.250.176.194
142.250.65.162
142.250.65.225
142.250.80.34
142.250.80.68
142.250.80.70
142.250.80.74
142.251.111.155
142.251.35.170
142.251.40.142
142.251.40.162
142.251.40.168
142.251.40.227
142.251.40.238
150.171.27.10
151.101.1.229
151.101.129.140
151.101.195.52
151.101.65.140
172.217.165.134
18.190.147.75
18.213.84.67
18.238.49.74
216.239.36.181
23.200.3.26
23.206.172.82
3.33.220.150
31.13.71.36
31.13.71.7
34.117.162.98
35.186.224.24
52.72.91.180
007c8eff670dc52481eeeb1b8fa5178b93c858fdb4b41a992bec57efc47c854a
03aac47c748e748a6a29a66040d8759abf375223b7b2e90431cc4f07b9c238be
0b037ba12cc1229d24149d936b1ef963d783b0822d5961a2227b364eda0f5da4
0c762bf714cf49ea12994c7a4e0ec0440f8524393c52f8468dd9c036371ca8ad
0e0c8cedb72a7e5a3080203509132486e267e5d1b0c5c6eae78ac16f7928ff01
0e8c2980a0fcbf254cdcf287b9a6fea312cfe26b6df7bddc6f44be0036321172
0f25d74b2b7cc729ceeb20792e1059415c4f2a69505def2d73e11b07db77061d
10e55e569ca31476055f4e4d330518740109bfc635e445073c31cf278a8add37
124e8df86b61a00c5b1cdf77552e3638426cb4505b80434a03d9687c8efc97cc
135feed90c43c79f7701f0a565f6b84a6adb15a1f63b349db07644e96e35ef81
15530d9ada4870ef8402ca4236cae63da8e660d12fbda0a6f9488bb68080491a
1593b1f5bf86a2bec3f93142409030a64591d1b6415faaedd0c251dd924d0288
172979e6450870385c50490a73957c7d987c375263d4740405f7c5bcc5c9e8a6
176f870235db68c0cd4c6c29c562f543dc46e485aa811eff9512b4cad122286d
183e25f10a5a556ed868cbb40e4e7c905377574e09e908440f0a96e0abbdb9d3
1891f036130e664daf89999cfaeb78cbf2d7116bb886c05b1b386d9433a998c0
19a80fd2c4ca6a8628967408dfce1768933d9d8f26ae617255b6faeecf545451
1a595a08f7cef40802cf52fb6b60bdcf76f25bb8e2a1a5eef70d407a8aa9ab99
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1e37b616b4dfba2c95070068b1f9811becb1f042c5eb0199ed38dcfd1f0960cb
22503a60891d5a6fc23323b1a5d0320ebcb163c13ea59f5c17a28edfab0ffa87
22ae6634834b5f8f875b93ab9ae03c44f58ee5327ab4fe4d2353a4aafc6aa62e
25e8f2a0f5931f8bd019e57488af5e80eff074607822f801465ffe3a8d8a4ff1
26c66fa725fbf034c9579e5587f2d02b75355bc14fe899a94326019c1e574dc9
270ae4a1e48f8511fca03917a94c938b0833268f80d193690025cb9e91975f3c
2eaff8c52f46fc588f2d14b084713299f44ca9c84fba1fbc21801f996f31fbc8
31898dd32435d144fc8ffe2aaa2302d5710759ba9616a6b67ca2fff0b824f661
3212ebacef9cb83c0a840ae6ced8e1fc6cb66cf5c24671955e363632f98458cc
341052fcc09b7f6ca560a8e5797c929ea5b150a61d76614f9d2704dece3bcb14
3605cb71891f707a7a7545666b88aa126749bbec0bfa36d4530a6dd807210ff2
3745507c9933fcd2662e38cb0adc71ec9b89dc596913e5f4c0149cdd3ada10b4
3f81536b077ab6f27380889b29eaa515bcc10242b7d2edced702705e5479e0b9
3fab98a127a8cba049fa0552692f70b455b078103dea0573a1389f32f09732f0
41f6f94451d85490ab6ae9f47879b02c77b39144ffb25ef6cec7748a45fc1cc4
42e2dd427dd9f9d45367c880c68289114b7de56373ff8bdc664ea0fa3ce77880
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45da241a91c843b268ada7481cdece1aa679f2720931effea28d83e1398d66a9
46d130e479753926c2b523dd664d69a1808bbbe4cf45e64c8343b67d5f5347a2
48fc55e6489e48dc026828fb2b4ed40d094272ff65405cc7cc039e94d6f9895a
4a519d2bd3043b930e0bbc73d78b2c4d672981401a8de9e846831502365c4509
4aab11207564611fc1258f396eac9bc804fc33bfd1f7993715c6e747015b1bf0
4b5816bbfc52587979139951355fe4048da02ce60e40cef8e4a1efb6cd396281
4e8276aea0a3c7fe3600e6718c7f484d49c347c8d5763d89be95900d526a14da
4f81013262bedeb10fe9ecd6d77a80065d7994bf69feba288203dbb42d2533aa
572c0e251ccc16eae904bceefc001375fcd80fa6bb58ddbf6857e0fc6417578f
5a117249cdc1f7687bab98dc2cacdebd9a56553cf2c87ca8d41245cd12a3321a
5b4cd288d3e8a30cc42ef00d38259343db21dd3544574d170ec681368f78dd37
5fde01dbdbdd1601aa54302a90e1528270a854062f96671d16232be20792829a
64b2b6f334780e21e14f6b0f4d02052a496c85ab5331389aed8bf19536d59940
65d76c2b6aaed27e43b6910243253ba795ed6db95ef8b9f619ae7274981eafab
66e9bf446316f6eec5eaefa7098592bbd2144a60eb38c481db233a6ca8b8d94a
690cd387ead73cd9f97afe3e29fe37200fe6adddecd182f61a734870ebab1123
69d72f4f5abb3e30b705273a1b8f9ef7adfeaa861d063dc41a1776f43b4213fb
6bdf7b45a11586c1dde75bec21a4a237ccf490e20772756f21f0b3ac08e57ed7
6dd7b3dcf25e1357e905dce8dd8f00aa558969bfb53fd6fd101afe12465cc2ae
7018a1ab979e80049d6bb8d223f28e5a65851d9b60f5f193e99527a12392ea06
71d18af9ee879a36717e1ea3367b669031e3f6b12cb0aa1373fd200d278c4e6a
73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4
7430e73ee9a36e97e9bf484512b94c6481e26a4a588ea72fd50d94b2168b0010
76829cfe9515fe98cee322829ed00c09a3a2bb6651d1575d809208d5bed94f27
7701282ea59743a1d336ee5ede4e6805ca9572c28ad013fa956fb39f18de0d69
77cb8ad87f43ae7ebcbeb49721cee249836f425195644da54daf56b01a53b8e5
77f3aa498a684bff60dad01d4db51bdf0bc4a21d52a4ba9eb14d838667ed44da
79951b5bd4d729a2b2f4d380819f2c14bbcf26f21db56a520189633467766cf4
8069be5157d53d356db90e2db793e37ba0554a800263b1e27cefacc764f5150e
830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375
876c808f691118d5a8f29e15f35c1d4d853fcee5f22e5265ab5cb98a9a65e157
8b35c6364fba567362c8d577bc907a05f69de0ed074fc038b821c9392d91c215
8d8d614f6e8f7c50dc312cd636071a99703a11e2ae88d8c4f59528212d0d503b
8ed40b4be7a49bbc6382f2b7439e6af9eb3a57b5575576d7c39f7085fbf2e3b2
92443d06835a28423649bca60e6d755e4a1bd09638443196d58e0dd1f06c827f
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
938fed89b32b95728d286f7635cc06391e173181cdf059caec5a06671218d60e
93bcd9640f3bb6636f0984e349c1b5f8c39652da8e7dad4a790142a2c2b376ac
964c0b64086012adfb77a29e441e55810429957ab059bb3806b144cb6f5a91b6
96d25b92b0462684cb78553b4897bee19884588ca7cb3df346b520b85ed72824
98f41a78867d2fdf26ea05f82e675a406091a744991912af96341b5e17a06a1b
9924c9ea04d10f130b3fe95b0e54529e1928300323430fd7b0f22e00dce0a425
9992412bb27e6f7246168320dd4efece61b87f8cdc3cb10bb568c5f5ebc4afa7
9a373ae6214168509dc4fe047f320b9d27bd87ed907d66806ce9b865ca55042a
9ab9e236fbed276d745c77da046d82876ec7101f0f3810e3ee7cd303bceaccde
9c0c9871e17c01315738923db55b38c3437fc294f271f6c48de5e422034b2d03
a1cdd9b51c7bf1286774891c3e8e198a14866757d6dd514021af92aafafb8208
a43888d0f7f3c84e8dc4c57d846989bcb0d97a96fe72212db8b9ab29eaffcb7d
a4743123c23b4fe0a43718c295c32ab34635be438878fd4a646d99e246740c19
a93c4c693046b143cc3a1a7c5b337df32f5265a68afe6a5483bd485d868301ac
a97207e0d8e9103e2413d4a919d3f67b3626d74039a05e2d0c8aacac87138ac2
a9f18a060ea2608fd9065cb888b1b71962ad495077024ccd8d7d8401d4bd578b
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aa9185ab1bfe6ccdf160f859377f2c8ed3b102c7a083bbbfb30d2ea3f26ff31f
ab3c7f0ed22ca2832a9095b788c3e5885f483f473a5dd5b8b357512df4c5c15a
b0088124edc0322d5cc6c4385ca59c018ceb76790c907d13f1ee5be3dcc1a039
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b20a071cdfcb68f29a4945d7f223975577258ee4d06529d1f60d10e7cf7a3c15
ba88a5687c96121ee1d1379c7dbbebf730ef4a88c33a6a108e794c096682c80a
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
bc3175e277f0f116e9d83d1e6e34f21bc7712208dd1bd99bdba78db50f9c6182
bd1ea1d3fc1088cf080e567465b3b3b4ca6fc288634136908011b275dcf2469a
bdb9e6b894c9b64f8ed9e0c7c3ccf8a612480659556a232f06f900473094a31b
c0cf6e482137a2b89de217e472c0fd200e55e9cd3ea8a5ae4c7ce30603d07a94
c34e28196cd412790c548696f1447aff0116ee662fead57bf578021e8cc01ba5
c4cc92ed03f28de663d36415d35c878c16b366a03a15f2ee06467fd73c3923a9
c7023059f33d393d808153256e01db33116be50bbf38cbe54dce1705b5c90c41
c7a5a9d453380c5b90175fa0d97313e7b826a7ea36a93b56fa0cbf8b0d365f79
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cee4bc15154afecee3b80d7ca28822e7de1df64822563aeb4bc122dc6c2ff05c
cfb903af89d7391946a8bbfdfab1ee478f3cf0a94db7d6b2f9473394cb1e40b1
d4498e20961b5d8f83de4b64281cb8af3d47c4e34947917b1f7f39c040d81808
d528947118524888924811ebee604ffb04e2e3c977d0250cbbcfabd05916a76e
d57f101b5c28ce7231b16adbbf13fc9793ede3248fa2c882fc5f392a6586b446
d6f22defa3db5ea3d15421b1c84cfc8ca073bccdeefac5a4c332142dc03050a1
d75d52f2f718f9592de9ac6bf277224085633fcf4b05f476ce307743ca298855
dbb470a6629c19bf4af9a9f7b5760788ce91530a5c604e6b7d27ba3def0b9826
dc559cfb7425831d237e62f1ffe7bbc5ff3cd13a77d5e5061f62ee937fa21045
dd623238995df78d795dccff1de9ba4ea55760b5251dc252fe9325d34495338c
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0fcb87986908d6bdd7123e108fc1142b80f2c04b19c8c63b2cdfa5035586848
e1356be068a3ddf9dcc7ba89e5efc6a28081ca58335bfaf76b9d8169a485c1eb
e2da86eaef8736d5928c8cf39e43470248e6fc545568b9659d4e3314bf5020c9
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4c69c2ae010da4ce119a3bd26a3f2fe4e050e55e5524db03ab455596b9363f7
e539f4739d8b9d700e5a1582820fe247453cbc7537fa6e30714ba6a6a51fc9bf
e87a029e8288a4324fa42c92fe3a2a7ade0f3106bd9573d66fce4eeead58ea00
e8e2bcc73dd1482eb119c643aa5c60e1c52e5c1469c003993eeb26675e980aab
ee11ea7fd40e017a0f38cbfa61d575f8942cc46ed684352b04b31fb689dfe576
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2dbfcf6f1472d0b5a5310d6935dfe414f53f3fea0001a0b32890a4b71e58beb
f309b7c03d9cae63a9bedbee6ed655f3dbcdb194132943639344dead5f3b9710
f55f223dadd14e54057b85eaaa1ee624e7fbbf0d5221174c8ff85f7bdd9de67b
faa4a82cd95d8230f6fa5024685dfd36e06f1b8085bab44b98193bb14f021add
ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99
ff85205ab1c4fe5e1510568c420432d785275715c23d3f611671a92b6ecfb220

www.ducks.org Open in urlscan Pro 13.35.93.104 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

182 Requests

96 %HTTPS

0 %IPv6

30 Domains

47 Subdomains

41 IPs

2 Countries

9433 kBTransfer

14733 kBSize

54 Cookies

25 Outgoing links

Page URL History

Redirected requests

182 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.ducks.org Open in urlscan Pro
13.35.93.104 Public Scan

Screenshot
Live screenshot

Full Image

182
Requests

96 %
HTTPS

0 %
IPv6

30
Domains

47
Subdomains

41
IPs

2
Countries

9433 kB
Transfer

14733 kB
Size

54
Cookies

182 HTTP transactions
3 data transactions