urlscan.io logo urlscan.io
SecurityTrails logo

www.helloborrow.org Open in urlscan Pro
76.76.21.123  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://helloborrow.org/
Effective URL: https://www.helloborrow.org/
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On November 08 via api from IT — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 2 countries across 6 domains to perform 39 HTTP transactions. The main IP is 76.76.21.123, located in Walnut, United States and belongs to AMAZON-02, US. The main domain is www.helloborrow.org.
TLS certificate: Issued by R12 on November 8th 2025. Valid for: 3 months.
This is the only time www.helloborrow.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 76.76.21.21 16509 (AMAZON-02)
4 76.76.21.123 16509 (AMAZON-02)
9 104.20.18.130 13335 (CLOUDFLAR...)
3 142.250.80.106 15169 (GOOGLE)
6 172.67.130.221 13335 (CLOUDFLAR...)
8 142.251.40.227 15169 (GOOGLE)
4 142.250.80.36 15169 (GOOGLE)
4 142.251.35.163 15169 (GOOGLE)
39 8
1    76.76.21.21 (Walnut, United States)

ASN16509 (AMAZON-02, US)
helloborrow.org
4    76.76.21.123 (Walnut, United States)

ASN16509 (AMAZON-02, US)
www.helloborrow.org
9    104.20.18.130 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)
formrequests.com
3    142.250.80.106 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s36-in-f10.1e100.net
fonts.googleapis.com
6    172.67.130.221 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)
datagate.leadsmarket.online
8    142.251.40.227 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s39-in-f3.1e100.net
fonts.gstatic.com
4    142.250.80.36 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s34-in-f4.1e100.net
www.google.com
4    142.251.35.163 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f3.1e100.net
www.gstatic.com
Apex Domain
Subdomains		 Transfer
12 gstatic.com
fonts.gstatic.com
www.gstatic.com
844 KB
9 formrequests.com
formrequests.com — Cisco Umbrella Rank: 298655
303 KB
6 leadsmarket.online
datagate.leadsmarket.online
2 KB
5 helloborrow.org
helloborrow.org
www.helloborrow.org
267 KB
4 google.com
www.google.com — Cisco Umbrella Rank: 2
67 KB
3 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 48
3 KB
39 6
Domain Requested by
9 formrequests.com www.helloborrow.org
formrequests.com
8 fonts.gstatic.com fonts.googleapis.com
www.google.com
6 datagate.leadsmarket.online formrequests.com
4 www.gstatic.com www.google.com
www.gstatic.com
4 www.google.com formrequests.com
www.gstatic.com
4 www.helloborrow.org www.helloborrow.org
3 fonts.googleapis.com client
formrequests.com
1 helloborrow.org 1 redirects
39 8

This site contains no links.

Subject Issuer Validity Valid
www.helloborrow.org
R12		 2025-11-08 -
2026-02-06		 3 months crt.sh
formrequests.com
WE1		 2025-10-04 -
2026-01-02		 3 months crt.sh
upload.video.google.com
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
datagate.leadsmarket.online
E7		 2025-11-06 -
2026-02-04		 3 months crt.sh
*.gstatic.com
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh
*.google.com
WR2		 2025-10-13 -
2026-01-05		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://www.helloborrow.org/
Frame ID: 39CAA899D9B5B33955FE69A75BCF0763
Requests: 33 HTTP requests in this frame

Frame: https://formrequests.com/custom/tracking_331914.html
Frame ID: E46D162EE7C14138B6080B617D125045
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld-mIMbAAAAAMq6VI2zivnqy2K4JcG9hBPCxUoK&co=aHR0cHM6Ly93d3cuaGVsbG9ib3Jyb3cub3JnOjQ0Mw..&hl=en&v=naPR4A6FAh-yZLuCX253WaZq&size=invisible&anchor-ms=20000&execute-ms=15000&cb=se7z88102ewa
Frame ID: F319D514BFF2708484EDBDC2C00A71CB
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

HelloBorrow

Page URL History Show full URLs

  1. https://helloborrow.org/ HTTP 307
    https://www.helloborrow.org/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

39
Requests

97 %
HTTPS

0 %
IPv6

6
Domains

8
Subdomains

8
IPs

2
Countries

1485 kB
Transfer

4288 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://helloborrow.org/ HTTP 307
    https://www.helloborrow.org/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

39 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.helloborrow.org/
Redirect Chain
  • https://helloborrow.org/
  • https://www.helloborrow.org/
2 KB
965 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.helloborrow.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.123 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
875f36da182075ab7950bc4cf5d850a5dab0bc0f1f36e30e0d83ce56d28fbe13
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
access-control-allow-origin
*
age
894
cache-control
public, max-age=0, must-revalidate
content-disposition
inline
content-encoding
br
content-length
663
content-type
text/html; charset=utf-8
date
Sat, 08 Nov 2025 05:18:34 GMT
etag
"8a82996217f4602a2fa3a48203c54fcf"
last-modified
Sat, 08 Nov 2025 05:03:39 GMT
server
Vercel
strict-transport-security
max-age=63072000
x-vercel-cache
HIT
x-vercel-id
iad1::w5wlq-1762579113969-a3dac916504b

Redirect headers

cache-control
public, max-age=0, must-revalidate
content-type
text/html
date
Sat, 08 Nov 2025 05:18:32 GMT
location
https://www.helloborrow.org/
server
Vercel
strict-transport-security
max-age=63072000
x-vercel-id
iad1::f4ksq-1762579112774-d35d9b97a5e1
index-Bz7_3eOj.js
www.helloborrow.org/assets/ 		818 KB
241 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.helloborrow.org/assets/index-Bz7_3eOj.js
Requested by
Host: www.helloborrow.org
URL: https://www.helloborrow.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.123 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
3a93beb7650e4278b10a98fd665390b728c28b107688d298434fa2685a430277
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=63072000
cache-control
public, max-age=0, must-revalidate
content-encoding
br
x-vercel-cache
HIT
etag
"047d5632037c6509b36dfd1315b51540"
age
798
accept-ranges
bytes
access-control-allow-origin
*
content-length
246527
date
Sat, 08 Nov 2025 05:18:34 GMT
content-disposition
inline; filename="index-Bz7_3eOj.js"
content-type
application/javascript; charset=utf-8
server
Vercel
last-modified
Sat, 08 Nov 2025 05:05:15 GMT
x-vercel-id
iad1::mwjd8-1762579114086-89a575490cb2
index-f0hS4gBp.css
www.helloborrow.org/assets/ 		75 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.helloborrow.org/assets/index-f0hS4gBp.css
Requested by
Host: www.helloborrow.org
URL: https://www.helloborrow.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.123 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
92bfb01a223ae917c16edc430a20f92219f8b38d3b84b9c927c3cccd4872c7ba
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=63072000
cache-control
public, max-age=0, must-revalidate
content-encoding
br
x-vercel-cache
HIT
etag
"70c7e8e0792ad4d2198538946a9145e1"
age
798
accept-ranges
bytes
access-control-allow-origin
*
content-length
13950
date
Sat, 08 Nov 2025 05:18:34 GMT
content-disposition
inline; filename="index-f0hS4gBp.css"
content-type
text/css; charset=utf-8
server
Vercel
last-modified
Sat, 08 Nov 2025 05:05:15 GMT
x-vercel-id
iad1::42w24-1762579114087-38bf068d9db0
form-loader.js
formrequests.com/installment36/1q_pd_im/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://formrequests.com/installment36/1q_pd_im/form-loader.js
Requested by
Host: www.helloborrow.org
URL: https://www.helloborrow.org/assets/index-Bz7_3eOj.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.18.130 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ec250755505c80f45565c04cf34a6dc330f808f3d89835aa82cd31ca8c76f40
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=0
content-encoding
br
cf-cache-status
DYNAMIC
etag
W/"690cba8e-335f"
cf-ray
99b29c4a8e35aaf1-YYZ
access-control-allow-origin
*
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
application/javascript
last-modified
Thu, 06 Nov 2025 15:11:10 GMT
server
cloudflare
favicon.png
www.helloborrow.org/ 		10 KB
11 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.helloborrow.org/favicon.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
76.76.21.123 Walnut, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Vercel /
Resource Hash
caca013d3afa69a588b5cad6066d4d6723805fbbeed859145eb91b188b0187dc
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=63072000
cache-control
public, max-age=0, must-revalidate
x-vercel-cache
HIT
etag
"114718051c1472739e4159a392bc7625"
age
798
accept-ranges
bytes
access-control-allow-origin
*
content-length
10613
date
Sat, 08 Nov 2025 05:18:34 GMT
content-disposition
inline; filename="favicon.png"
content-type
image/png
server
Vercel
last-modified
Sat, 08 Nov 2025 05:05:15 GMT
x-vercel-id
iad1::w5wlq-1762579114376-c4aa4ae174b2
truncated
/ 		311 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e99b83c87a941ab8ceed2d6b26713643ea7b8d040c9a966b5aa1262372dd4824

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
ccpa-app.js
formrequests.com/ccpa/ 		76 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://formrequests.com/ccpa/ccpa-app.js
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.18.130 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e82fc802a887d0210aef0b7b5396f401530f004111781905b86d4257184cef91
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=0
content-encoding
br
cf-cache-status
HIT
etag
W/"690cba9a-12e68"
age
6421
cf-ray
99b29c4b2eb7aaf1-YYZ
access-control-allow-origin
*
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
application/javascript
last-modified
Thu, 06 Nov 2025 15:11:22 GMT
server
cloudflare
vary
accept-encoding
css
fonts.googleapis.com/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Montserrat:400,700
Requested by
Host: client
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.80.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s36-in-f10.1e100.net
Software
ESF /
Resource Hash
61234baeedf71c53be7eed4df10b3b9acec61ae2e25882949c27f1b10e9d2cad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 08 Nov 2025 05:18:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 08 Nov 2025 04:13:13 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
hit.core.js
formrequests.com/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://formrequests.com/hit.core.js
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.18.130 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
438d170478fceb9fec1e337d03345dab11c0e0a8347a5efe40af48a64a89e650
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=0
content-encoding
br
cf-cache-status
HIT
etag
W/"690e7940-1ceb"
age
6982
cf-ray
99b29c4b3ebeaaf1-YYZ
access-control-allow-origin
*
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
application/javascript
last-modified
Fri, 07 Nov 2025 22:57:04 GMT
server
cloudflare
vary
accept-encoding
theme5.css
formrequests.com/installment36/1q_pd_im/ 		88 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://formrequests.com/installment36/1q_pd_im/theme5.css
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.18.130 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
079bd6e64d8a6c46585430370728714fb70a709046f9ce39f0db498be322903f
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=0
content-encoding
br
cf-cache-status
HIT
etag
W/"690cba8e-15f26"
age
3044
cf-ray
99b29c4b3ebcaaf1-YYZ
access-control-allow-origin
*
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
text/css
last-modified
Thu, 06 Nov 2025 15:11:10 GMT
server
cloudflare
vary
accept-encoding
app.js
formrequests.com/installment36/1q_pd_im/ 		1016 KB
221 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://formrequests.com/installment36/1q_pd_im/app.js?v=272432756
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.18.130 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29883e6f2e18146b0736fe88f9e161fd1773283b40d9a702b294cc7e62dfa86c
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=0
content-encoding
br
cf-cache-status
DYNAMIC
etag
W/"690e7891-fde12"
cf-ray
99b29c4b3ebfaaf1-YYZ
access-control-allow-origin
*
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
application/javascript
last-modified
Fri, 07 Nov 2025 22:54:09 GMT
server
cloudflare
vary
accept-encoding
async.css
formrequests.com/installment36/1q_pd_im/ 		41 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://formrequests.com/installment36/1q_pd_im/async.css
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.18.130 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f70e46d29633e807012a4c6b4b98c9741a10fca134e34d55d21045bcc35d3e2
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=0
content-encoding
br
cf-cache-status
HIT
etag
W/"690cba8e-a332"
age
4620
cf-ray
99b29c4b3ebdaaf1-YYZ
access-control-allow-origin
*
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
text/css
last-modified
Thu, 06 Nov 2025 15:11:10 GMT
server
cloudflare
vary
accept-encoding
registerHit
datagate.leadsmarket.online/api/visitor/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://datagate.leadsmarket.online/api/visitor/registerHit?clienturl=https%3A//www.helloborrow.org/&rnd=0.5310956090205012&responsetype=json&o=480&ReferrerURL=&c=331914&sourceSubId=direct&v1=na&v2=na&v3=home&v4=50cc769e-9747-4c15-a45b-3709d258f506
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.130.221 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.helloborrow.org
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
GET
access-control-allow-origin
https://www.helloborrow.org
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
99b29c4bbb6caaca-YYZ
date
Sat, 08 Nov 2025 05:18:34 GMT
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority
u=1,i
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qi7SopCX4yQ4qhVj2niGgabsUwquekrO0Dsd30EqmJxXJFmcmMVFM3NYX6ZjXGiAO3TQT21PNWNvJyjqTmW85lh3Lyf9f7HDK3IRs8a9Oi8dvy%2FMpU3LsHh2pQ%3D%3D"}]}
server
cloudflare
server-timing
cfExtPri
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin
registerHit
datagate.leadsmarket.online/api/visitor/ 		118 B
762 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://datagate.leadsmarket.online/api/visitor/registerHit?clienturl=https%3A//www.helloborrow.org/&rnd=0.5310956090205012&responsetype=json&o=480&ReferrerURL=&c=331914&sourceSubId=direct&v1=na&v2=na&v3=home&v4=50cc769e-9747-4c15-a45b-3709d258f506
Requested by
Host: formrequests.com
URL: https://formrequests.com/hit.core.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.130.221 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0acb10d2e947ff9a42e8e941bf997d55cee4ade33933cf902b0200ba96fa688
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=JgHLzDeYg8xOvReKwsZ8I7q%2Bk%2Fr5SrQUdWx3Ato6Djrcof0Ch8aeQmYtEeAEDijPHz%2BaBnmanjsfXHRWK%2FJuZcFnrZuUNFVaYTyCTYZMhlKj3B6pHKHB4TC29g%3D%3D"}]}
cf-ray
99b29c4c7ab3b404-YYZ
access-control-allow-origin
https://www.helloborrow.org
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 08 Nov 2025 05:18:35 GMT
content-type
application/json; charset=utf-8
vary
Origin
server
cloudflare
priority
u=1,i
css
fonts.googleapis.com/ 		3 KB
676 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Montserrat:400,600
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/theme5.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.80.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s36-in-f10.1e100.net
Software
ESF /
Resource Hash
d87f009ed06c63a9a6dde217f930c0f1bdfd68070e4b82dc0b9f32b28e701ff3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://formrequests.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 08 Nov 2025 05:18:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 08 Nov 2025 04:27:03 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
ccpa-app.css
formrequests.com/ccpa/ 		15 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://formrequests.com/ccpa/ccpa-app.css
Requested by
Host: formrequests.com
URL: https://formrequests.com/ccpa/ccpa-app.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.18.130 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d1e9193832ce79eae43af3afd8579b3f6139382c02b3a70e4431df137210d3b5
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=0
content-encoding
br
cf-cache-status
HIT
etag
W/"690cba9a-3bde"
age
6421
cf-ray
99b29c4b7ef8aaf1-YYZ
access-control-allow-origin
*
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
text/css
last-modified
Thu, 06 Nov 2025 15:11:22 GMT
server
cloudflare
vary
accept-encoding
css
fonts.googleapis.com/ 		16 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Roboto:400,500,700&display=swap
Requested by
Host: formrequests.com
URL: https://formrequests.com/ccpa/ccpa-app.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.80.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s36-in-f10.1e100.net
Software
ESF /
Resource Hash
f30a2f101b045d24748cdbb5e2082e3216ae8ecfcc2f091af638786d3eced120
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://formrequests.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 08 Nov 2025 05:18:34 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 08 Nov 2025 05:18:34 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 08 Nov 2025 04:18:50 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
getstate
datagate.leadsmarket.online/api/misc/ 		13 B
512 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://datagate.leadsmarket.online/api/misc/getstate?checkForCA=true
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/app.js?v=272432756
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.130.221 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3f13a010d5f72e8023e4685adf0e58fc511e7bc9db482695ecf8d6e99e22a49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZvKt25EA4j5S0StfFyCtV5AgZFsA7b8MlSvsmlf0eTVV5qNoJtL220Nblu0dG%2F9woVVBkF1XykklAzcOUSzMq9hDDvkdrCY1QL%2ByqSZb0PeT2a2mnZThSJ4nwQ%3D%3D"}]}
cf-ray
99b29c4cfb7daaca-YYZ
access-control-allow-origin
https://www.helloborrow.org
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 08 Nov 2025 05:18:35 GMT
content-type
application/json; charset=utf-8
vary
Origin
server
cloudflare
priority
u=1,i
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f4157c3b57f211b62147124fd4db0aaa5f6facdddc11d24bcd801bf168b156e1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f42bf69e7df44ddb558257c6c6ecd87d4c16afcfe89da2c72da78393991f2675

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6255162d4a36b04ed37b8d6f26015164cbe78094606ab10311d1cae31c4d2ce7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a30f6dcd0b556de709dd43073f725a8973803ca82c32a59d5cecbb8f47977564

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v31/ 		37 KB
37 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,700
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s39-in-f3.1e100.net
Software
sffe /
Resource Hash
06b16db7a969135d48d38c49183be7fb88d4452e2a3011957c7851941f4e4879
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://fonts.googleapis.com/

Response headers

age
190603
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 06 Nov 2026 00:21:52 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 06 Nov 2025 00:21:52 GMT
last-modified
Thu, 04 Sep 2025 17:09:22 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
37956
x-xss-protection
0
server
sffe
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v31/ 		37 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,600
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s39-in-f3.1e100.net
Software
sffe /
Resource Hash
06b16db7a969135d48d38c49183be7fb88d4452e2a3011957c7851941f4e4879
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://fonts.googleapis.com/

Response headers

age
190603
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 06 Nov 2026 00:21:52 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 06 Nov 2025 00:21:52 GMT
last-modified
Thu, 04 Sep 2025 17:09:22 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
37956
x-xss-protection
0
server
sffe
KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
fonts.gstatic.com/s/roboto/v49/ 		39 KB
39 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v49/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s39-in-f3.1e100.net
Software
sffe /
Resource Hash
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://fonts.googleapis.com/

Response headers

age
188735
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 06 Nov 2026 00:53:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 06 Nov 2025 00:53:00 GMT
last-modified
Mon, 08 Sep 2025 18:08:05 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
40128
x-xss-protection
0
server
sffe
KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
fonts.gstatic.com/s/roboto/v49/ 		39 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v49/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s39-in-f3.1e100.net
Software
sffe /
Resource Hash
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://fonts.googleapis.com/

Response headers

age
188735
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 06 Nov 2026 00:53:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 06 Nov 2025 00:53:00 GMT
last-modified
Mon, 08 Sep 2025 18:08:05 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
40128
x-xss-protection
0
server
sffe
KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
fonts.gstatic.com/s/roboto/v49/ 		39 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v49/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s39-in-f3.1e100.net
Software
sffe /
Resource Hash
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://fonts.googleapis.com/

Response headers

age
188735
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 06 Nov 2026 00:53:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 06 Nov 2025 00:53:00 GMT
last-modified
Mon, 08 Sep 2025 18:08:05 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
40128
x-xss-protection
0
server
sffe
tracking_331914.html
formrequests.com/custom/ Frame E46D 		0
129 B 		Document
General
Check archive.org
Download Go to
Full URL
https://formrequests.com/custom/tracking_331914.html
Requested by
Host: formrequests.com
URL: https://formrequests.com/hit.core.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.18.130 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

Referer
https://www.helloborrow.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

cf-cache-status
DYNAMIC
cf-ray
99b29c513dbdebbd-YYZ
content-encoding
br
content-type
text/html
date
Sat, 08 Nov 2025 05:18:35 GMT
server
cloudflare
strict-transport-security
max-age=0
getCampaignStatus
datagate.leadsmarket.online/api/misc/ 		63 B
561 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://datagate.leadsmarket.online/api/misc/getCampaignStatus?formName=paydayv3/1q_pd_im&form_theme=theme5&host=www.helloborrow.org&hitGuid=ee0044d5-b667-4959-8494-e9ee8f95c1a9&v=2.247.3&testID=
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/app.js?v=272432756
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.130.221 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1485d91fe3c7655758b3df3347a22d27e1f9df39688dbdf0851cbeff00bd0e51
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Referer
https://www.helloborrow.org/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=J4D80ObLtYBsiV%2FIW17lslyuU4K5W6fHUAFvGYh9EbEFqWsUeKL0ffzeFVJwTLtrwg8kooKe%2FwWdnJLA7ibfjQYFr48YpQwwqEv7jZVzzaethNzM0XEIuRikZQ%3D%3D"}]}
cf-ray
99b29c4f6b9daaca-YYZ
access-control-allow-origin
https://www.helloborrow.org
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 08 Nov 2025 05:18:35 GMT
content-type
application/json; charset=utf-8
vary
Origin
server
cloudflare
priority
u=1,i
api.js
www.google.com/recaptcha/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?onload=sendInvisibleRecaptchaToken
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/app.js?v=272432756
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f4.1e100.net
Software
ESF /
Resource Hash
92bb2f9a39c1f86dc21dbba4c55baf98e99b6d304dee16be7c4e48503d8a2b8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

cache-control
private, max-age=300
content-encoding
gzip
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options
nosniff
expires
Sat, 08 Nov 2025 05:18:35 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date
Sat, 08 Nov 2025 05:18:35 GMT
x-xss-protection
0
content-type
text/javascript; charset=utf-8
server
ESF
x-frame-options
SAMEORIGIN
recaptcha__en.js
www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/ 		812 KB
346 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=sendInvisibleRecaptchaToken
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.35.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s78-in-f3.1e100.net
Software
sffe /
Resource Hash
d4883381009ff8e5c4b05722f62b60f6182b1d2a0631d12fe4075026bac1929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://www.helloborrow.org/

Response headers

content-encoding
gzip
age
15096
report-to
{"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options
nosniff
expires
Sun, 08 Nov 2026 01:06:59 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 08 Nov 2025 01:06:59 GMT
last-modified
Mon, 03 Nov 2025 01:02:43 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges
bytes
access-control-allow-origin
*
content-length
353816
x-xss-protection
0
server
sffe
JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v31/ 		37 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/montserrat/v31/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat:400,600
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s39-in-f3.1e100.net
Software
sffe /
Resource Hash
06b16db7a969135d48d38c49183be7fb88d4452e2a3011957c7851941f4e4879
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://fonts.googleapis.com/

Response headers

age
190603
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 06 Nov 2026 00:21:52 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 06 Nov 2025 00:21:52 GMT
last-modified
Thu, 04 Sep 2025 17:09:22 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
37956
x-xss-protection
0
server
sffe
icomoon.ttf
formrequests.com/installment36/1q_pd_im/fonts/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://formrequests.com/installment36/1q_pd_im/fonts/icomoon.ttf?dh4j0
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/theme5.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.20.18.130 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff496fcead2c6f04da045498dced08783d62dc92f3c121617bd551f7b14721f3
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.helloborrow.org
Referer
https://formrequests.com/installment36/1q_pd_im/theme5.css

Response headers

strict-transport-security
max-age=0
cf-cache-status
DYNAMIC
etag
"690cba8e-828"
cf-ray
99b29c524f3faaf7-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
2088
date
Sat, 08 Nov 2025 05:18:35 GMT
content-type
application/octet-stream
last-modified
Thu, 06 Nov 2025 15:11:10 GMT
server
cloudflare
vary
accept-encoding
anchor
www.google.com/recaptcha/api2/ Frame F319 		77 KB
45 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld-mIMbAAAAAMq6VI2zivnqy2K4JcG9hBPCxUoK&co=aHR0cHM6Ly93d3cuaGVsbG9ib3Jyb3cub3JnOjQ0Mw..&hl=en&v=naPR4A6FAh-yZLuCX253WaZq&size=invisible&anchor-ms=20000&execute-ms=15000&cb=se7z88102ewa
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f4.1e100.net
Software
ESF /
Resource Hash
0ea6db537e6c43c79f7296a691f57b1a34755f49e713683ee66b0803ddf4b3a1
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-O2YW4ceW3yWsXHFXnVIePQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.helloborrow.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-O2YW4ceW3yWsXHFXnVIePQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy
cross-origin
date
Sat, 08 Nov 2025 05:18:35 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server
ESF
x-content-type-options
nosniff
x-xss-protection
0
styles__ltr.css
www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/ Frame F319 		81 KB
42 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld-mIMbAAAAAMq6VI2zivnqy2K4JcG9hBPCxUoK&co=aHR0cHM6Ly93d3cuaGVsbG9ib3Jyb3cub3JnOjQ0Mw..&hl=en&v=naPR4A6FAh-yZLuCX253WaZq&size=invisible&anchor-ms=20000&execute-ms=15000&cb=se7z88102ewa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.35.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s78-in-f3.1e100.net
Software
sffe /
Resource Hash
9ed7b552641c3004138810ee9d628ecdb90fb8b3c561eddf52da41aaea323c37
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.google.com/

Response headers

content-encoding
gzip
age
51130
report-to
{"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options
nosniff
expires
Sat, 07 Nov 2026 15:06:26 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 07 Nov 2025 15:06:26 GMT
last-modified
Mon, 03 Nov 2025 01:02:43 GMT
content-type
text/css
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges
bytes
content-length
42506
x-xss-protection
0
server
sffe
recaptcha__en.js
www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/ Frame F319 		812 KB
346 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld-mIMbAAAAAMq6VI2zivnqy2K4JcG9hBPCxUoK&co=aHR0cHM6Ly93d3cuaGVsbG9ib3Jyb3cub3JnOjQ0Mw..&hl=en&v=naPR4A6FAh-yZLuCX253WaZq&size=invisible&anchor-ms=20000&execute-ms=15000&cb=se7z88102ewa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.35.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s78-in-f3.1e100.net
Software
sffe /
Resource Hash
d4883381009ff8e5c4b05722f62b60f6182b1d2a0631d12fe4075026bac1929f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.google.com/

Response headers

content-encoding
gzip
age
15097
report-to
{"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options
nosniff
expires
Sun, 08 Nov 2026 01:06:59 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 08 Nov 2025 01:06:59 GMT
last-modified
Mon, 03 Nov 2025 01:02:43 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges
bytes
access-control-allow-origin
*
content-length
353816
x-xss-protection
0
server
sffe
webworker.js
www.google.com/recaptcha/api2/ Frame F319 		0
0
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame F319 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/styles__ltr.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.35.163 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s78-in-f3.1e100.net
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/styles__ltr.css

Response headers

age
209511
report-to
{"group":"recaptcha-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha-scs"}]}
x-content-type-options
nosniff
expires
Wed, 12 Nov 2025 19:06:45 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 05 Nov 2025 19:06:45 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
content-type
image/png
cache-control
public, max-age=604800
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha-scs"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha-scs
accept-ranges
bytes
content-length
2228
x-xss-protection
0
server
sffe
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame F319 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld-mIMbAAAAAMq6VI2zivnqy2K4JcG9hBPCxUoK&co=aHR0cHM6Ly93d3cuaGVsbG9ib3Jyb3cub3JnOjQ0Mw..&hl=en&v=naPR4A6FAh-yZLuCX253WaZq&size=invisible&anchor-ms=20000&execute-ms=15000&cb=se7z88102ewa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s39-in-f3.1e100.net
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.google.com
Referer
https://www.google.com/

Response headers

age
190485
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 06 Nov 2026 00:23:51 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 06 Nov 2025 00:23:51 GMT
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
15344
x-xss-protection
0
server
sffe
KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame F319 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld-mIMbAAAAAMq6VI2zivnqy2K4JcG9hBPCxUoK&co=aHR0cHM6Ly93d3cuaGVsbG9ib3Jyb3cub3JnOjQ0Mw..&hl=en&v=naPR4A6FAh-yZLuCX253WaZq&size=invisible&anchor-ms=20000&execute-ms=15000&cb=se7z88102ewa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.227 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s39-in-f3.1e100.net
Software
sffe /
Resource Hash
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Origin
https://www.google.com
Referer
https://www.google.com/

Response headers

age
208939
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Thu, 05 Nov 2026 19:16:17 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 05 Nov 2025 19:16:17 GMT
last-modified
Mon, 16 Oct 2017 17:33:02 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
15552
x-xss-protection
0
server
sffe
reload
www.google.com/recaptcha/api2/ Frame F319 		37 KB
21 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/reload?k=6Ld-mIMbAAAAAMq6VI2zivnqy2K4JcG9hBPCxUoK
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/naPR4A6FAh-yZLuCX253WaZq/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f4.1e100.net
Software
ESF /
Resource Hash
974510eda9d0314c911e899dabf0fe3757cc8081656e9cb1991fd4dd3fdcb150
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Content-Type
application/x-protobuffer
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld-mIMbAAAAAMq6VI2zivnqy2K4JcG9hBPCxUoK&co=aHR0cHM6Ly93d3cuaGVsbG9ib3Jyb3cub3JnOjQ0Mw..&hl=en&v=naPR4A6FAh-yZLuCX253WaZq&size=invisible&anchor-ms=20000&execute-ms=15000&cb=se7z88102ewa

Response headers

cache-control
private
content-encoding
gzip
cross-origin-resource-policy
same-site
report-to
{"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options
nosniff
expires
Sat, 08 Nov 2025 05:18:37 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date
Sat, 08 Nov 2025 05:18:37 GMT
x-xss-protection
0
content-type
application/json; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
server
ESF
x-frame-options
SAMEORIGIN
saveRecaptchaScore
datagate.leadsmarket.online/api/misc/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://datagate.leadsmarket.online/api/misc/saveRecaptchaScore
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.130.221 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.helloborrow.org
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://www.helloborrow.org
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
99b29c5b0bfdaaca-YYZ
date
Sat, 08 Nov 2025 05:18:37 GMT
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority
u=1,i
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=A%2BCrcD26JSsuJT2jQ7qQWziPVBNs%2BE1DeFFevUHvgh3vF0ntsTudOqeqB%2B%2Bto6rdWvQFC1BnsklYAeWu60V2f9qyej4E5o4jt1dMMIAhxhsP%2BvHUoaezcg88Vw%3D%3D"}]}
server
cloudflare
server-timing
cfExtPri
strict-transport-security
max-age=31536000; includeSubDomains
vary
Origin
saveRecaptchaScore
datagate.leadsmarket.online/api/misc/ 		32 B
532 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://datagate.leadsmarket.online/api/misc/saveRecaptchaScore
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/app.js?v=272432756
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.130.221 , Ascension Island, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f7364cb030aee798ebf7f1fd6fce9ccb40452dad9c22ac234924a7d60c030bc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.helloborrow.org/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Content-Type
application/json

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
zstd
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=W%2BCtmLGQ9RP1YrLuKozUd4dYP0OBX6ComlADXagw5m6YwOOJww7ZlMZTYogK0iVp8SUkCuMeODkqopftwpJX2yls0k10qEsUMvUWrZXwcKNhKdGz4vDRJKBqGw%3D%3D"}]}
cf-ray
99b29c5b9bffaaca-YYZ
access-control-allow-origin
https://www.helloborrow.org
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 08 Nov 2025 05:18:37 GMT
content-type
application/json; charset=utf-8
vary
Origin
server
cloudflare
priority
u=1,i
clr
www.google.com/recaptcha/api2/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/clr?k=6Ld-mIMbAAAAAMq6VI2zivnqy2K4JcG9hBPCxUoK
Requested by
Host: formrequests.com
URL: https://formrequests.com/installment36/1q_pd_im/app.js?v=272432756
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s34-in-f4.1e100.net
Software
ESF /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Referer
https://www.helloborrow.org/

Response headers

cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
content-length
0
date
Sat, 08 Nov 2025 05:18:37 GMT
x-xss-protection
0
content-type
application/binary
server
ESF
x-frame-options
SAMEORIGIN

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.google.com
URL
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=naPR4A6FAh-yZLuCX253WaZq

Verdicts & Comments Add Verdict or Comment

168 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 string| __reactRouterVersion object| lmpost function| __jsf__themeResolver object| __jsf__ number| timeJSForms boolean| __PROD_CONSOLE_SILENCED__ object| __jsf__Cnsmrvrfy function| hitregistersuccess boolean| hitcorejsalreadyfired function| __jsf__registerHit object| dataLayer boolean| __ccpa_init__ object| __ccpa__ object| __core-js_shared__ object| core function| Zone function| __zone_symbol__Promise function| __zone_symbol__ZoneAwarePromise function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| __zone_symbol__ononabortpatched boolean| __zone_symbol__ononanimationendpatched boolean| __zone_symbol__ononanimationiterationpatched boolean| __zone_symbol__ononauxclickpatched boolean| __zone_symbol__ononbeforeinputpatched boolean| __zone_symbol__ononblurpatched boolean| __zone_symbol__ononcancelpatched boolean| __zone_symbol__ononcanplaypatched boolean| __zone_symbol__ononcanplaythroughpatched boolean| __zone_symbol__ononchangepatched boolean| __zone_symbol__ononcuechangepatched boolean| __zone_symbol__ononclickpatched boolean| __zone_symbol__ononclosepatched boolean| __zone_symbol__ononcontextmenupatched boolean| __zone_symbol__onondblclickpatched boolean| __zone_symbol__onondragpatched boolean| __zone_symbol__onondragendpatched boolean| __zone_symbol__onondragenterpatched boolean| __zone_symbol__onondragleavepatched boolean| __zone_symbol__onondragoverpatched boolean| __zone_symbol__onondroppatched boolean| __zone_symbol__onondurationchangepatched boolean| __zone_symbol__ononemptiedpatched boolean| __zone_symbol__ononendedpatched boolean| __zone_symbol__ononerrorpatched boolean| __zone_symbol__ononfocuspatched boolean| __zone_symbol__onongotpointercapturepatched boolean| __zone_symbol__ononinputpatched boolean| __zone_symbol__ononinvalidpatched boolean| __zone_symbol__ononkeydownpatched boolean| __zone_symbol__ononkeypresspatched boolean| __zone_symbol__ononkeyuppatched boolean| __zone_symbol__ononloadpatched boolean| __zone_symbol__ononloadstartpatched boolean| __zone_symbol__ononloadeddatapatched boolean| __zone_symbol__ononloadedmetadatapatched boolean| __zone_symbol__ononlostpointercapturepatched boolean| __zone_symbol__ononmousedownpatched boolean| __zone_symbol__ononmouseenterpatched boolean| __zone_symbol__ononmouseleavepatched boolean| __zone_symbol__ononmousemovepatched boolean| __zone_symbol__ononmouseoutpatched boolean| __zone_symbol__ononmouseoverpatched boolean| __zone_symbol__ononmouseuppatched boolean| __zone_symbol__ononmousewheelpatched boolean| __zone_symbol__ononpausepatched boolean| __zone_symbol__ononplaypatched boolean| __zone_symbol__ononplayingpatched boolean| __zone_symbol__ononpointercancelpatched boolean| __zone_symbol__ononpointerdownpatched boolean| __zone_symbol__ononpointerenterpatched boolean| __zone_symbol__ononpointerleavepatched boolean| __zone_symbol__ononpointermovepatched boolean| __zone_symbol__ononpointeroverpatched boolean| __zone_symbol__ononpointeruppatched boolean| __zone_symbol__ononprogresspatched boolean| __zone_symbol__ononratechangepatched boolean| __zone_symbol__ononresetpatched boolean| __zone_symbol__ononresizepatched boolean| __zone_symbol__ononscrollpatched boolean| __zone_symbol__ononseekedpatched boolean| __zone_symbol__ononseekingpatched boolean| __zone_symbol__ononselectpatched boolean| __zone_symbol__ononselectionchangepatched boolean| __zone_symbol__ononselectstartpatched boolean| __zone_symbol__ononstalledpatched boolean| __zone_symbol__ononsubmitpatched boolean| __zone_symbol__ononsuspendpatched boolean| __zone_symbol__onontimeupdatepatched boolean| __zone_symbol__ononvolumechangepatched boolean| __zone_symbol__onontransitioncancelpatched boolean| __zone_symbol__onontransitionendpatched boolean| __zone_symbol__ononwaitingpatched boolean| __zone_symbol__ononwheelpatched boolean| __zone_symbol__onontogglepatched boolean| __zone_symbol__ononafterprintpatched boolean| __zone_symbol__ononappinstalledpatched boolean| __zone_symbol__ononbeforeinstallpromptpatched boolean| __zone_symbol__ononbeforeprintpatched boolean| __zone_symbol__ononbeforeunloadpatched boolean| __zone_symbol__onondevicemotionpatched boolean| __zone_symbol__onondeviceorientationpatched boolean| __zone_symbol__onondeviceorientationabsolutepatched boolean| __zone_symbol__ononhashchangepatched boolean| __zone_symbol__ononlanguagechangepatched boolean| __zone_symbol__ononmessagepatched boolean| __zone_symbol__ononofflinepatched boolean| __zone_symbol__onononlinepatched boolean| __zone_symbol__ononpageshowpatched boolean| __zone_symbol__ononpagehidepatched boolean| __zone_symbol__ononpopstatepatched boolean| __zone_symbol__ononrejectionhandledpatched boolean| __zone_symbol__ononstoragepatched boolean| __zone_symbol__ononunhandledrejectionpatched boolean| __zone_symbol__ononunloadpatched boolean| __zone_symbol__onondragstartpatched boolean| __zone_symbol__ononanimationstartpatched boolean| __zone_symbol__ononsearchpatched boolean| __zone_symbol__onontransitionrunpatched boolean| __zone_symbol__onontransitionstartpatched boolean| __zone_symbol__ononwebkitanimationendpatched boolean| __zone_symbol__ononwebkitanimationiterationpatched boolean| __zone_symbol__ononwebkitanimationstartpatched boolean| __zone_symbol__ononwebkittransitionendpatched boolean| __zone_symbol__ononcommandpatched boolean| __zone_symbol__ononpointeroutpatched boolean| __zone_symbol__ononmessageerrorpatched boolean| ngDevMode object| __zone_symbol__messagefalse function| setImmediate function| clearImmediate object| ng object| __zone_symbol__popstatefalse object| __zone_symbol__beforeunloadfalse function| getAngularTestability function| getAllAngularTestabilities function| getAllAngularRootElements object| frameworkStabilizers function| __zone_symbol__ON_PROPERTYbeforeunload boolean| hitregistered function| sendInvisibleRecaptchaToken object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| __zone_symbol__loadfalse object| closure_lm_349075 function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener function| eventListeners function| removeAllListeners

4 Cookies

Domain/Path Name / Value
www.google.com/recaptcha Name: _GRECAPTCHA
Value: 09ADiQh0fRBGKEkvXrUSJEX1vn7NrpPrWQH_ZCafywWKvTG1469OLk1vsWmEGViuD_ncPCnb4_UMLSU3TLQZDxiBY
www.helloborrow.org/ Name: lm_campid
Value: 331914
.leadsmarket.online/ Name: hit
Value: uid%3Dee0044d5-b667-4959-8494-e9ee8f95c1a9
www.helloborrow.org/ Name: hit
Value: uid=ee0044d5-b667-4959-8494-e9ee8f95c1a9

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=63072000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

datagate.leadsmarket.online
fonts.googleapis.com
fonts.gstatic.com
formrequests.com
helloborrow.org
www.google.com
www.gstatic.com
www.helloborrow.org
www.google.com
104.20.18.130
142.250.80.106
142.250.80.36
142.251.35.163
142.251.40.227
172.67.130.221
76.76.21.123
76.76.21.21
06b16db7a969135d48d38c49183be7fb88d4452e2a3011957c7851941f4e4879
079bd6e64d8a6c46585430370728714fb70a709046f9ce39f0db498be322903f
0ea6db537e6c43c79f7296a691f57b1a34755f49e713683ee66b0803ddf4b3a1
0f70e46d29633e807012a4c6b4b98c9741a10fca134e34d55d21045bcc35d3e2
0f7364cb030aee798ebf7f1fd6fce9ccb40452dad9c22ac234924a7d60c030bc
1485d91fe3c7655758b3df3347a22d27e1f9df39688dbdf0851cbeff00bd0e51
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
29883e6f2e18146b0736fe88f9e161fd1773283b40d9a702b294cc7e62dfa86c
3a93beb7650e4278b10a98fd665390b728c28b107688d298434fa2685a430277
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3ec250755505c80f45565c04cf34a6dc330f808f3d89835aa82cd31ca8c76f40
438d170478fceb9fec1e337d03345dab11c0e0a8347a5efe40af48a64a89e650
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
61234baeedf71c53be7eed4df10b3b9acec61ae2e25882949c27f1b10e9d2cad
6255162d4a36b04ed37b8d6f26015164cbe78094606ab10311d1cae31c4d2ce7
875f36da182075ab7950bc4cf5d850a5dab0bc0f1f36e30e0d83ce56d28fbe13
92bb2f9a39c1f86dc21dbba4c55baf98e99b6d304dee16be7c4e48503d8a2b8e
92bfb01a223ae917c16edc430a20f92219f8b38d3b84b9c927c3cccd4872c7ba
974510eda9d0314c911e899dabf0fe3757cc8081656e9cb1991fd4dd3fdcb150
9ed7b552641c3004138810ee9d628ecdb90fb8b3c561eddf52da41aaea323c37
a30f6dcd0b556de709dd43073f725a8973803ca82c32a59d5cecbb8f47977564
caca013d3afa69a588b5cad6066d4d6723805fbbeed859145eb91b188b0187dc
d1e9193832ce79eae43af3afd8579b3f6139382c02b3a70e4431df137210d3b5
d4883381009ff8e5c4b05722f62b60f6182b1d2a0631d12fe4075026bac1929f
d87f009ed06c63a9a6dde217f930c0f1bdfd68070e4b82dc0b9f32b28e701ff3
e0acb10d2e947ff9a42e8e941bf997d55cee4ade33933cf902b0200ba96fa688
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e82fc802a887d0210aef0b7b5396f401530f004111781905b86d4257184cef91
e99b83c87a941ab8ceed2d6b26713643ea7b8d040c9a966b5aa1262372dd4824
f30a2f101b045d24748cdbb5e2082e3216ae8ecfcc2f091af638786d3eced120
f3f13a010d5f72e8023e4685adf0e58fc511e7bc9db482695ecf8d6e99e22a49
f4157c3b57f211b62147124fd4db0aaa5f6facdddc11d24bcd801bf168b156e1
f42bf69e7df44ddb558257c6c6ecd87d4c16afcfe89da2c72da78393991f2675
ff496fcead2c6f04da045498dced08783d62dc92f3c121617bd551f7b14721f3