urlscan.io logo urlscan.io
SecurityTrails logo

buy.stripe.com
18.238.55.37  Public Scan Open in urlscan Pro

Go To Rescan Add Verdict Report
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci 5yr old
Submission: On May 23 via api from IE — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 18.238.55.37, located in United States and belongs to AMAZON-02, US. The main domain is buy.stripe.com. The Cisco Umbrella rank of the primary domain is 175694. 5yr old
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on April 1st 2025. Valid for: 3mo.
This is the only time buy.stripe.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 18.238.55.37 16509 (AMAZON-02)
5 151.101.128.176 54113 (FASTLY)
3 23.22.133.111 14618 (AMAZON-AES)
1 3.90.98.12 14618 (AMAZON-AES)
1 54.186.23.98 16509 (AMAZON-02)
14 6
1    18.238.55.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-55-37.jfk52.r.cloudfront.net
buy.stripe.com 5yr old
5    151.101.128.176 (San Francisco, United States)

ASN54113 (FASTLY, US)
js.stripe.com 13yr old
3    23.22.133.111 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-22-133-111.compute-1.amazonaws.com
merchant-ui-api.stripe.com 4yr old
1    3.90.98.12 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-90-98-12.compute-1.amazonaws.com
checkout-cookies.stripe.com 3yr old
1    54.186.23.98 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ip-54-186-23-98.stripe.com
r.stripe.com 5yr old
Apex Domain
Subdomains		 Transfer
11 stripe.com
buy.stripe.com — Cisco Umbrella Rank: 175694 5yr old
js.stripe.com Failed — Cisco Umbrella Rank: 1256 13yr old
merchant-ui-api.stripe.com — Cisco Umbrella Rank: 7203 4yr old
checkout-cookies.stripe.com — Cisco Umbrella Rank: 82504 3yr old
r.stripe.com — Cisco Umbrella Rank: 2529 5yr old
371 KB
14 1
Domain Requested by
5 js.stripe.com buy.stripe.com
js.stripe.com
3 merchant-ui-api.stripe.com buy.stripe.com
1 r.stripe.com buy.stripe.com
1 checkout-cookies.stripe.com buy.stripe.com
1 buy.stripe.com
14 5

This site contains no links.

Subject Issuer Validity Valid
a.stripecdn.com
DigiCert SHA2 Extended Validation Server CA		 2025-04-01 -
2025-07-10		 3mo crt.sh
*.stripe.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2025-04-01 -
2025-07-03		 3mo crt.sh

This page contains 3 frames:

Primary Page: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Frame ID: 4F04E432EF244843196B4EEFC68B059F
Requests: 11 HTTP requests in this frame

Frame: https://js.stripe.com/v3/link-login-inner-f93c75f376651b28bcf0446ffa241e7e.html
Frame ID: 65D354266F72B06EFBE3C484E156FA74
Requests: 2 HTTP requests in this frame

Frame: https://js.stripe.com/v3/checkout-inner-origin-frame-5ba772c37cea51b729d42369f36c781f.html
Frame ID: E9C64B7F60E0F9C34D56B6317969C4C9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Stripe Checkout

Detected technologies

Overall confidence: 100%
Detected patterns
  • js\.stripe\.com

Page Statistics

14
Requests

79 %
HTTPS

0 %
IPv6

1
Domains

5
Subdomains

6
IPs

1
Countries

371 kB
Transfer

1536 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 5kAg0MaEE0GbcBW3ci
buy.stripe.com/ 		357 KB
86 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.55.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-55-37.jfk52.r.cloudfront.net
Software
Cloudfront /
Resource Hash
0eacfaea26d9024844e456384f735f7ba8b3ce45c367fb009875c5b0b41521f4
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://js.stripe.com https://r.stripe.com https://checkout-cookies.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://merchant-ui-api.stripe.com; default-src 'self'; font-src 'self' https://js.stripe.com; form-action 'none'; frame-src 'self' https://js.stripe.com https://payments.stripe.com https://checkout.link.com; img-src 'self' https://q.stripe.com https://js.stripe.com https://stripe-camo.global.ssl.fastly.net https://d1wqzb5bdbcre6.cloudfront.net https://qr.stripe.com https://b.stripecdn.com https://files.stripe.com; media-src 'none'; object-src 'none'; script-src 'self' https://js.stripe.com 'sha256-BNulBYV1JXGvq9NQg7814ZyyVZCqfRI1aq5d+PSIdgI=' 'sha256-rlo7/i+MlcDKSihdP4FoP9C+4Be0hh+o0AGxTi40DQs=' 'sha256-agVSHA/eAewTYmLxzAIytt5bR5BkvZAzCaHuhH9ScyM='; style-src 'self' https://js.stripe.com 'sha256-ERqgw/VCzal0GVy+XtwzIr+xXko1B0H49allNX1w69w='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
age
45
alt-svc
h3=":443"; ma=86400
cache-control
max-age=60, stale-while-revalidate=900
content-encoding
br
content-security-policy
base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://js.stripe.com https://r.stripe.com https://checkout-cookies.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://merchant-ui-api.stripe.com; default-src 'self'; font-src 'self' https://js.stripe.com; form-action 'none'; frame-src 'self' https://js.stripe.com https://payments.stripe.com https://checkout.link.com; img-src 'self' https://q.stripe.com https://js.stripe.com https://stripe-camo.global.ssl.fastly.net https://d1wqzb5bdbcre6.cloudfront.net https://qr.stripe.com https://b.stripecdn.com https://files.stripe.com; media-src 'none'; object-src 'none'; script-src 'self' https://js.stripe.com 'sha256-BNulBYV1JXGvq9NQg7814ZyyVZCqfRI1aq5d+PSIdgI=' 'sha256-rlo7/i+MlcDKSihdP4FoP9C+4Be0hh+o0AGxTi40DQs=' 'sha256-agVSHA/eAewTYmLxzAIytt5bR5BkvZAzCaHuhH9ScyM='; style-src 'self' https://js.stripe.com 'sha256-ERqgw/VCzal0GVy+XtwzIr+xXko1B0H49allNX1w69w='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 23 May 2025 16:00:07 GMT
etag
W/"b650ee232e33074b7fa54e42d91ce807"
last-modified
Thu, 22 May 2025 23:33:50 GMT
origin-agent-cluster
?1
server
Cloudfront
strict-transport-security
max-age=31556926; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
via
1.1 9ff0b6c9de3fbfb51f9f14244e2651a4.cloudfront.net (CloudFront)
x-amz-cf-id
fiI-BdXm20GsfzuGUxvlmAJf3pZ65u9jxghTXzQrBcYbkUTo-UpwnA==
x-amz-cf-pop
JFK52-P4
x-cache
Hit from cloudfront
x-content-type-options
nosniff
checkout-app-init-1b77445ec07c0eb2d0b5589ea131e17a.js
js.stripe.com/v3/fingerprinted/js/ 		0
0
checkout-app-init-738e432eb037b171546c984862ccafd0.css
js.stripe.com/v3/fingerprinted/css/ 		402 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/fingerprinted/css/checkout-app-init-738e432eb037b171546c984862ccafd0.css
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.128.176 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
ad656a589f162d5c17ad8feca60e3fd0c6f596507f54953646961281873ae1d6
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer
https://buy.stripe.com/

Response headers

x-request-id
f3fa6f33-6f02-4053-a1a1-f728b0a82a6c
content-encoding
br
etag
"c61b0ae66ab7ac851ab67c2d70aa6033"
age
61188
x-content-type-options
nosniff
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT
date
Fri, 23 May 2025 16:00:38 GMT
last-modified
Thu, 22 May 2025 22:42:24 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-mad2200100-MAD
x-cache-hits
75
vary
Accept-Encoding
strict-transport-security
max-age=31556926; includeSubDomains; preload
cache-control
max-age=31536000
timing-allow-origin
*
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
50777
server
Fastly
vendor-500ce7964aa0055e4c9e520d0a2dff6b.js
js.stripe.com/v3/fingerprinted/js/ 		647 KB
177 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/fingerprinted/js/vendor-500ce7964aa0055e4c9e520d0a2dff6b.js
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.128.176 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
3acb9f7ec304fda53db655844870ca0e994235419d69e58a58e599fd766ce3e0
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Referer
https://buy.stripe.com/

Response headers

x-request-id
6c10f19c-7044-48e8-a234-a929d94a259d
content-encoding
br
etag
"aa3d09724c272e30b42d26e8643ad928"
age
823318
x-content-type-options
nosniff
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT
date
Fri, 23 May 2025 16:00:38 GMT
last-modified
Wed, 30 Apr 2025 20:32:09 GMT
content-type
text/javascript; charset=utf-8
x-served-by
cache-mad2200100-MAD
x-cache-hits
1
vary
Accept-Encoding
strict-transport-security
max-age=31556926; includeSubDomains; preload
cache-control
max-age=31536000
timing-allow-origin
*
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
180894
server
Fastly
stripe-aedca008d0b0b3511be701c2a1fdfb1f.js
js.stripe.com/v3/fingerprinted/js/ 		0
0
5kAg0MaEE0GbcBW3ci
merchant-ui-api.stripe.com/payment-links/ 		12 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://merchant-ui-api.stripe.com/payment-links/5kAg0MaEE0GbcBW3ci
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.22.133.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-22-133-111.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1ab687f59a41dfd8d9f29aa76dbe364eacc74b978e068b43cf21421c8e8b3040
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'; worker-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=zTbEuc7nLGpUHBQGB7o5l1S9EmwJmgC34yljVpgzA4w-mTqGipa8fopTQyl4mCCcJIF9CjsH65Z-OYg%3D
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://buy.stripe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept
application/json
Content-Type
application/x-www-form-urlencoded

Response headers

x-robots-tag
none
access-control-max-age
300
x-wc
ABCDGHI
x-stripe-proxy-response
upstream
report-to
{"group":"coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report"}],"include_subdomains":true}
access-control-allow-methods
GET, POST
request-id
req_xnaBFo1xBg9zGR
expires
0
x-content-type-options
nosniff
x-stripe-server-rpc-duration-micros
590548
date
Fri, 23 May 2025 16:00:40 GMT
content-type
application/json; charset=UTF-8
vary
Origin
strict-transport-security
max-age=63072000; includeSubDomains; preload
reporting-endpoints
coop="https://q.stripe.com/coop-report"
content-security-policy
base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'; worker-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=zTbEuc7nLGpUHBQGB7o5l1S9EmwJmgC34yljVpgzA4w-mTqGipa8fopTQyl4mCCcJIF9CjsH65Z-OYg%3D
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-stripe-routing-context-priority-tier
livemode-critical
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
x-stripe-priority-routing-enabled
true
access-control-allow-origin
*
content-length
12190
server
nginx
5kAg0MaEE0GbcBW3ci
merchant-ui-api.stripe.com/payment-links/ 		249 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://merchant-ui-api.stripe.com/payment-links/5kAg0MaEE0GbcBW3ci
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.22.133.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-22-133-111.compute-1.amazonaws.com
Software
nginx /
Resource Hash
0fae00e969658086f622b8038684439b4a7440dd4eafca9a32eb0cfc4d416ca1
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'; worker-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=zTbEuc7nLGpUHBQGB7o5l1S9EmwJmgC34yljVpgzA4w-mTqGipa8fopTQyl4mCCcJIF9CjsH65Z-OYg%3D
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://buy.stripe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept
application/json
Content-Type
application/x-www-form-urlencoded

Response headers

x-robots-tag
none
access-control-max-age
300
x-wc
ABCDGHI
x-stripe-proxy-response
upstream
report-to
{"group":"coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report"}],"include_subdomains":true}
access-control-allow-methods
GET, POST
request-id
req_rEO5XiiNwEGXep
expires
0
x-content-type-options
nosniff
x-stripe-server-rpc-duration-micros
43577
date
Fri, 23 May 2025 16:00:39 GMT
content-type
application/json; charset=UTF-8
vary
Origin
strict-transport-security
max-age=63072000; includeSubDomains; preload
reporting-endpoints
coop="https://q.stripe.com/coop-report"
content-security-policy
base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'; worker-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=zTbEuc7nLGpUHBQGB7o5l1S9EmwJmgC34yljVpgzA4w-mTqGipa8fopTQyl4mCCcJIF9CjsH65Z-OYg%3D
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-stripe-routing-context-priority-tier
livemode
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
x-stripe-priority-routing-enabled
true
access-control-allow-origin
*
content-length
249
server
nginx
get-cookie
merchant-ui-api.stripe.com/link/ 		35 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://merchant-ui-api.stripe.com/link/get-cookie
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.22.133.111 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-23-22-133-111.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8d0c04f065692bfeb27d08b1aa3c98a734abdfdabd44cc5f5757e20ac6ff7ff3
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'; worker-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=Spb6i4lgFQZlPvAYBnpGWe9neyZT4GbGxyl1f1FqMngjtJEF6PRBdnzPJGfWqKSm4PFOUaCaotcegHg%3D
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://buy.stripe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept
application/json
Content-Type
application/x-www-form-urlencoded

Response headers

x-robots-tag
none
access-control-max-age
300
x-wc
ABCDGHI
x-stripe-proxy-response
upstream
report-to
{"group":"coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report"}],"include_subdomains":true}
access-control-allow-methods
GET, POST
request-id
req_yZJ2dUKHAgGagk
expires
0
x-content-type-options
nosniff
x-stripe-server-rpc-duration-micros
11452
date
Fri, 23 May 2025 16:00:38 GMT
content-type
application/json; charset=UTF-8
vary
Origin
strict-transport-security
max-age=63072000; includeSubDomains; preload
reporting-endpoints
coop="https://q.stripe.com/coop-report"
content-security-policy
base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'self'; script-src 'self' 'report-sample'; style-src 'self'; worker-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=Spb6i4lgFQZlPvAYBnpGWe9neyZT4GbGxyl1f1FqMngjtJEF6PRBdnzPJGfWqKSm4PFOUaCaotcegHg%3D
cache-control
max-age=0, no-cache, no-store, must-revalidate
x-stripe-routing-context-priority-tier
livemode
pragma
no-cache
access-control-allow-credentials
true
referrer-policy
strict-origin-when-cross-origin
x-stripe-priority-routing-enabled
true
access-control-allow-origin
https://buy.stripe.com
content-length
35
server
nginx
get-cookie
checkout-cookies.stripe.com/api/ 		35 B
916 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://checkout-cookies.stripe.com/api/get-cookie
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.90.98.12 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-90-98-12.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8d0c04f065692bfeb27d08b1aa3c98a734abdfdabd44cc5f5757e20ac6ff7ff3
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'none'; script-src 'none' 'report-sample'; style-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=aHOf4OPjpfy0gEJ6Bw0sIn0YVvppI4Ls9Ozx05-MFc2Ve33pgJ7pnRxfHcBhKgJTXv_fjnDN5b9XbPbq
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://buy.stripe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept
application/json
Content-Type
application/x-www-form-urlencoded

Response headers

x-robots-tag
none
access-control-max-age
300
x-wc
ABCDGHI
x-stripe-proxy-response
upstream
report-to
{"group":"coop","max_age":8640,"endpoints":[{"url":"https://q.stripe.com/coop-report"}],"include_subdomains":true}
access-control-allow-methods
GET, POST
x-content-type-options
nosniff
expires
0
x-stripe-server-rpc-duration-micros
14742
date
Fri, 23 May 2025 16:00:39 GMT
content-type
application/json; charset=UTF-8
vary
Origin
strict-transport-security
max-age=63072000; includeSubDomains; preload
reporting-endpoints
coop="https://q.stripe.com/coop-report"
content-security-policy
base-uri 'none'; default-src 'none'; form-action 'none'; frame-ancestors 'none'; img-src 'none'; script-src 'none' 'report-sample'; style-src 'none'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=aHOf4OPjpfy0gEJ6Bw0sIn0YVvppI4Ls9Ozx05-MFc2Ve33pgJ7pnRxfHcBhKgJTXv_fjnDN5b9XbPbq
cache-control
max-age=0, no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-credentials
true
referrer-policy
strict-origin-when-cross-origin
access-control-allow-origin
https://buy.stripe.com
content-length
35
server
nginx
.deploy_status_henson.json
js.stripe.com/v3/ 		474 B
666 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/.deploy_status_henson.json
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.128.176 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
aa60a3a678d17f60e8b586020361041d740cba03ac8325aa1ca86b0d062ec16d
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

Referer
https://buy.stripe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept
application/json
Content-Type
application/x-www-form-urlencoded

Response headers

x-request-id
306a198e-ad7f-447b-8702-c74c2eeccf40
content-encoding
br
etag
"3c76310da4d84931da08ae40098f427e"
age
5
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT
date
Fri, 23 May 2025 16:00:40 GMT
last-modified
Thu, 22 May 2025 23:33:50 GMT
vary
Accept-Encoding
x-cache-hits
3
content-type
application/json
x-served-by
cache-toj-leto2350049-TOJ
strict-transport-security
max-age=31556926; includeSubDomains; preload
cache-control
max-age=60
timing-allow-origin
*
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
295
server
Fastly
link-login-inner-f93c75f376651b28bcf0446ffa241e7e.html
js.stripe.com/v3/ Frame 65D3 		65 KB
22 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/link-login-inner-f93c75f376651b28bcf0446ffa241e7e.html
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.128.176 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
ef15dca405ea366d14cbdb6982594005873db64e51079e2727cfb6188b3eccf9
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self' 'sha256-nXGvwERnajWRPVChFzt2sOpq2eJFzmA/xIlV1W9FnP4='; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
1
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control
max-age=60, stale-while-revalidate=900
content-encoding
br
content-length
22128
content-security-policy
base-uri 'none'; connect-src 'self' https://api.stripe.com https://merchant-ui-api.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://errors.stripe.com https://r.stripe.com; default-src 'self'; font-src 'none'; form-action 'none'; frame-src 'self'; img-src 'self' https://q.stripe.com; media-src 'none'; object-src 'none'; script-src 'self' 'sha256-nXGvwERnajWRPVChFzt2sOpq2eJFzmA/xIlV1W9FnP4='; style-src 'self' 'sha256-0hAheEzaMe6uXIKV4EehS9pu1am1lj/KnnzrOYqckXk='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 23 May 2025 16:00:39 GMT
etag
"38e76b9672da236b0a7459878ba8b7c6"
last-modified
Thu, 22 May 2025 22:42:38 GMT
origin-agent-cluster
?1
server
Fastly
strict-transport-security
max-age=31556926; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
via
1.1 varnish
x-cache
HIT
x-cache-hits
15269
x-content-type-options
nosniff
x-request-id
702994cb-3aef-42cf-be0a-06a9d0de102f
x-served-by
cache-mad2200100-MAD
checkout-inner-origin-frame-5ba772c37cea51b729d42369f36c781f.html
js.stripe.com/v3/ Frame E9C6 		52 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://js.stripe.com/v3/checkout-inner-origin-frame-5ba772c37cea51b729d42369f36c781f.html
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.128.176 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
b6a9872dfe08a86c92fcf60b75cd377dd767618f6fe56869615707a3f869b68a
Security Headers
Name Value
Content-Security-Policy base-uri 'none'; connect-src https://api.stripe.com https://r.stripe.com https://js.stripe.com; default-src 'none'; font-src 'none'; form-action 'none'; img-src 'none'; object-src 'none'; script-src 'self' 'sha256-XDwXkvHRQ4QQPvkwGx6Xz3KWV8rM0pzVI3HSHTl7HFM='; style-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://buy.stripe.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
61189
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control
max-age=31536000
content-encoding
br
content-length
17720
content-security-policy
base-uri 'none'; connect-src https://api.stripe.com https://r.stripe.com https://js.stripe.com; default-src 'none'; font-src 'none'; form-action 'none'; img-src 'none'; object-src 'none'; script-src 'self' 'sha256-XDwXkvHRQ4QQPvkwGx6Xz3KWV8rM0pzVI3HSHTl7HFM='; style-src 'none'; report-uri https://q.stripe.com/csp-report
content-type
text/html; charset=utf-8
date
Fri, 23 May 2025 16:00:39 GMT
etag
"b56796e0fe119eb316c96199f13b7311"
last-modified
Thu, 22 May 2025 22:42:24 GMT
origin-agent-cluster
?1
server
Fastly
strict-transport-security
max-age=31556926; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
via
1.1 varnish
x-cache
HIT
x-cache-hits
106
x-content-type-options
nosniff
x-request-id
b8f03427-c93c-4150-8358-429773d228e7
x-served-by
cache-mad2200100-MAD
stripe-cookies-0365765a4afa0da4fe353e8fa3bd8a03.js
js.stripe.com/v3/fingerprinted/js/ Frame 65D3 		0
0
b
r.stripe.com/ 		0
470 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://r.stripe.com/b
Requested by
Host: buy.stripe.com
URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
54.186.23.98 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ip-54-186-23-98.stripe.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://buy.stripe.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept
application/json
Content-Type
application/x-www-form-urlencoded

Response headers

x-stripe-proxy-response
upstream
x-envoy-attempt-count
1
access-control-allow-methods
POST
x-stripe-bg-intended-route-color
green
x-stripe-server-rpc-duration-micros
3790
x-stripe-outbound-proxy-type
envoy
x-stripe-inbound-proxy-type
mesh-proxy
date
Fri, 23 May 2025 16:00:41 GMT
content-type
text/plain
x-stripe-server-envoy-upstream-service-time-ms
3
access-control-allow-credentials
true
x-stripe-upstream-host
10.76.131.78:1643
access-control-allow-origin
https://buy.stripe.com
content-length
0
x-stripe-server-envoy-start-time-us
1748016041686837
x-stripe-client-envoy-start-time-us
1748016041686540
server
nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
js.stripe.com
URL
https://js.stripe.com/v3/fingerprinted/js/checkout-app-init-1b77445ec07c0eb2d0b5589ea131e17a.js
Domain
js.stripe.com
URL
https://js.stripe.com/v3/fingerprinted/js/stripe-aedca008d0b0b3511be701c2a1fdfb1f.js?stripeCheckoutInitialized=true
Domain
js.stripe.com
URL
https://js.stripe.com/v3/fingerprinted/js/stripe-cookies-0365765a4afa0da4fe353e8fa3bd8a03.js

Verdicts & Comments Add Verdict or Comment

4 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| __tti object| webpackChunkStripeJShosted

0 Cookies

2 Console Messages

Source Level URL
Text
other warning URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Message:
<link rel=preload> uses an unsupported `as` value
other warning URL: https://buy.stripe.com/5kAg0MaEE0GbcBW3ci
Message:
<link rel=preload> uses an unsupported `as` value

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy base-uri 'none'; connect-src 'self' https://api.stripe.com https://errors.stripe.com https://js.stripe.com https://r.stripe.com https://checkout-cookies.stripe.com https://stripe.com/cookie-settings/enforcement-mode https://merchant-ui-api.stripe.com; default-src 'self'; font-src 'self' https://js.stripe.com; form-action 'none'; frame-src 'self' https://js.stripe.com https://payments.stripe.com https://checkout.link.com; img-src 'self' https://q.stripe.com https://js.stripe.com https://stripe-camo.global.ssl.fastly.net https://d1wqzb5bdbcre6.cloudfront.net https://qr.stripe.com https://b.stripecdn.com https://files.stripe.com; media-src 'none'; object-src 'none'; script-src 'self' https://js.stripe.com 'sha256-BNulBYV1JXGvq9NQg7814ZyyVZCqfRI1aq5d+PSIdgI=' 'sha256-rlo7/i+MlcDKSihdP4FoP9C+4Be0hh+o0AGxTi40DQs=' 'sha256-agVSHA/eAewTYmLxzAIytt5bR5BkvZAzCaHuhH9ScyM='; style-src 'self' https://js.stripe.com 'sha256-ERqgw/VCzal0GVy+XtwzIr+xXko1B0H49allNX1w69w='; worker-src 'none'; report-uri https://q.stripe.com/csp-report
Strict-Transport-Security max-age=31556926; includeSubDomains; preload
X-Content-Type-Options nosniff