There is mixed (https and http) content appearing occasionally to me.
It seems to appear at the same time, but maybe not always as it couldn't catch it again a couple of days ago when I first noticed it, as an ad for Tesco:
The URL requested is
http://bs.serving-sys.com/serving/adServer.bs?cn=display&c=19&mc=imp&pli=29957092&PluID=0&ord=1433594164&rtu=-1
The response for the URL is:
HTTP/1.1 200
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: image/gif
Expires: Sun, 05-Jun-2005 22:00:00 GMT
Server: Microsoft-IIS/7.5
Set-Cookie: S_29957092=534465219734297496; expires=Thu, 10-Sep-2020 20:53:00 GMT
A6=03Hj19tud5000CsY000000000; expires=Tue, 08-Dec-2020 04:53:00 GMT; domain=.serving-sys.com; path=/
eyeblaster=; expires=Mon, 01-Jan-2000 00:00:00 GMT; domain=.serving-sys.com; path=/
u2=047dafd5-f688-4514-8ec9-d3bf62e7c2644xi080; expires=Tue, 08-Dec-2020 04:53:00 GMT; domain=.serving-sys.com; path=/
Access-Control-Allow-Origin: *
X-Powered-By: ASP.NET
P3P: CP="NOI DEVa OUR BUS UNI"
Date: Wed, 09 Sep 2020 08:53:16 GMT
Content-Length: 42
The ad is in an <iframe>
:
<iframe style="border: 0px none; vertical-align: bottom;" src="https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html" id="google_ads_iframe_/248424177/stackoverflow.com/sb/question-pages_0" title="3rd party ad content" name="" scrolling="no" marginwidth="0" marginheight="0" data-is-safeframe="true" sandbox="allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-top-navigation-by-user-activation" data-google-container-id="1" data-load-complete="true" width="300" height="250" frameborder="0">
so perhaps setting upgrade-insecure-requests
, as mentioned in Mixed content ad, is ineffective for this.
More information: http://bs.serving-sys.com
tells us that it "is a Sizmek Advertising Server". Following the link to the Sizmek home page tells us that it is "Sizmek by Amazon", so perhaps it is not associated with what appears to be an ad served by Google.