urlscan.io logo urlscan.io
SecurityTrails logo

onehourtaxrefund.com Open in urlscan Pro
192.46.236.38  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.onehourtaxrefund.com/
Effective URL: https://onehourtaxrefund.com/
Submission: On March 15 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 34 IPs in 4 countries across 22 domains to perform 101 HTTP transactions. The main IP is 192.46.236.38, located in Frankfurt am Main, Germany and belongs to LINODE-AP Linode, LLC, US. The main domain is onehourtaxrefund.com.
TLS certificate: Issued by R3 on March 15th 2021. Valid for: 3 months.
This is the only time onehourtaxrefund.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 30 192.46.236.38 63949 (LINODE-AP...)
1 2a00:1450:400... 15169 (GOOGLE)
3 2600:9000:211... 16509 (AMAZON-02)
1 2600:9000:218... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
20 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 151.101.12.217 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
1 2 23.111.9.38 33438 (HIGHWINDS2)
1 172.217.16.130 15169 (GOOGLE)
2 2a03:2880:f02... 32934 (FACEBOOK)
1 65.9.58.103 16509 (AMAZON-02)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 3.97.87.100 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
5 151.101.114.109 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f12... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
1 151.101.64.217 54113 (FASTLY)
1 34.120.202.204 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 52.21.115.144 14618 (AMAZON-AES)
1 13.226.159.11 16509 (AMAZON-02)
1 18.233.241.134 14618 (AMAZON-AES)
101 34
30    192.46.236.38 (Frankfurt am Main, Germany)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: depro16.fcomet.com
www.onehourtaxrefund.com
onehourtaxrefund.com
1    2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
3    2600:9000:211e:9200:2:6f7a:6f00:93a1 (United States)

ASN16509 (AMAZON-02, US)
mlszglajsdf2.i.optimole.com
1    2600:9000:2182:7400:11:20a2:4300:21 (United States)

ASN16509 (AMAZON-02, US)
d5jmkjjpb7yfg.cloudfront.net
1    2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
20    2a00:1450:4001:803::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.youtube.com
2    2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    151.101.12.217 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
player.vimeo.com
2    2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
2    23.111.9.38 (United States)

ASN33438 (HIGHWINDS2, US)
cdn.mouseflow.com
1    172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net
www.googleadservices.com
2    2a03:2880:f02d:12:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)
connect.facebook.net
1    65.9.58.103 (United States)

ASN16509 (AMAZON-02, US)
cdn.funnelytics.io
2    2606:4700::6811:925b (United States)

ASN13335 (CLOUDFLARENET, US)
diffuser-cdn.app-us1.com
prism.app-us1.com
1    2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2a00:1450:400c:c09::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
3    3.97.87.100 (Montreal, Canada)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-97-87-100.ca-central-1.compute.amazonaws.com
track-v2.funnelytics.io
3    2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
5    151.101.114.109 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
i.vimeocdn.com
f.vimeocdn.com
2    2a00:1450:4001:808::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
static.doubleclick.net
3    2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
yt3.ggpht.com
2    2a00:1450:4001:82a::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
i.ytimg.com
2    2a03:2880:f12d:83:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    151.101.64.217 (United States)

ASN54113 (FASTLY, US)
vimeo.com
1    34.120.202.204 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 204.202.120.34.bc.googleusercontent.com
fresnel.vimeocdn.com
2    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
1    52.21.115.144 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-21-115-144.compute-1.amazonaws.com
trackcmp.net
1    13.226.159.11 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-11.dus51.r.cloudfront.net
wp-ui.app-us1.com
1    18.233.241.134 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-233-241-134.compute-1.amazonaws.com
personalization-wp-service.cluster.app-us1.com
Domain Requested by
29 onehourtaxrefund.com onehourtaxrefund.com
20 www.youtube.com onehourtaxrefund.com
www.youtube.com
4 www.google.com onehourtaxrefund.com
www.youtube.com
3 f.vimeocdn.com player.vimeo.com
3 googleads.g.doubleclick.net www.googleadservices.com
www.youtube.com
3 track-v2.funnelytics.io cdn.funnelytics.io
3 fonts.gstatic.com fonts.googleapis.com
www.youtube.com
3 mlszglajsdf2.i.optimole.com onehourtaxrefund.com
2 www.gstatic.com www.youtube.com
2 www.facebook.com onehourtaxrefund.com
connect.facebook.net
2 i.ytimg.com www.youtube.com
2 yt3.ggpht.com www.youtube.com
2 static.doubleclick.net www.youtube.com
2 i.vimeocdn.com player.vimeo.com
2 www.google.de onehourtaxrefund.com
2 connect.facebook.net onehourtaxrefund.com
connect.facebook.net
2 cdn.mouseflow.com 1 redirects onehourtaxrefund.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
1 personalization-wp-service.cluster.app-us1.com wp-ui.app-us1.com
1 wp-ui.app-us1.com diffuser-cdn.app-us1.com
1 trackcmp.net diffuser-cdn.app-us1.com
1 fresnel.vimeocdn.com f.vimeocdn.com
1 vimeo.com f.vimeocdn.com
1 prism.app-us1.com diffuser-cdn.app-us1.com
1 stats.g.doubleclick.net www.google-analytics.com
1 diffuser-cdn.app-us1.com onehourtaxrefund.com
1 cdn.funnelytics.io onehourtaxrefund.com
1 www.googleadservices.com www.googletagmanager.com
1 player.vimeo.com onehourtaxrefund.com
1 www.googletagmanager.com onehourtaxrefund.com
1 d5jmkjjpb7yfg.cloudfront.net onehourtaxrefund.com
1 fonts.googleapis.com onehourtaxrefund.com
1 www.onehourtaxrefund.com 1 redirects
101 33

This site contains links to these domains. Also see Links.

Domain
www.globes.co.il
oran-yehieli-app.clickfunnels.com
Subject Issuer Validity Valid
onehourtaxrefund.com
R3		 2021-03-15 -
2021-06-13		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
*.i.optimole.com
Amazon		 2020-06-10 -
2021-07-10		 a year crt.sh
*.cloudfront.net
DigiCert Global CA G2		 2020-05-26 -
2021-04-21		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
*.google.com
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
vimeo.map.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-08-07 -
2021-04-24		 9 months crt.sh
*.mouseflow.com
Sectigo RSA Domain Validation Secure Server CA		 2020-06-12 -
2022-09-14		 2 years crt.sh
www.googleadservices.com
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2021-02-10 -
2021-05-10		 3 months crt.sh
*.funnelytics.io
Amazon		 2021-01-06 -
2022-02-03		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-15 -
2021-08-15		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
www.google.com
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
www.google.de
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2021-03-09 -
2021-04-17		 a month crt.sh
*.doubleclick.net
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
*.googleusercontent.com
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
edgestatic.com
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
*.google.de
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh
fresnel.vimeocdn.com
GTS CA 1D2		 2021-03-14 -
2021-06-12		 3 months crt.sh
*.trackcmp.net
Amazon		 2021-03-02 -
2022-03-31		 a year crt.sh
*.app-us1.com
Amazon		 2021-02-03 -
2022-03-04		 a year crt.sh
*.cluster.app-us1.com
Amazon		 2021-03-04 -
2022-04-02		 a year crt.sh

This page contains 4 frames:

Primary Page: https://onehourtaxrefund.com/
Frame ID: 20B084314E0F3D13698AC4E918576203
Requests: 60 HTTP requests in this frame

Frame: https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Frame ID: 9E911AA8C0C61D5C82F39DCDBC1244F4
Requests: 18 HTTP requests in this frame

Frame: https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Frame ID: 1F8940BD0993D73C42C89DB2870960A8
Requests: 18 HTTP requests in this frame

Frame: https://player.vimeo.com/video/453031223?color=ffffff&portrait=0&title=0&byline=0&badge=0&autoplay=0&loop=0
Frame ID: B3220FDD12BA13CCD2B4CBAC2485C069
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://www.onehourtaxrefund.com/ HTTP 301
    https://onehourtaxrefund.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /cdn\.mouseflow\.com/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

101
Requests

100 %
HTTPS

64 %
IPv6

22
Domains

33
Subdomains

34
IPs

4
Countries

2332 kB
Transfer

8374 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.onehourtaxrefund.com/ HTTP 301
    https://onehourtaxrefund.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 41
  • https://cdn.mouseflow.com/projects/baa9b4aa-557f-4799-a97e-005e87b57d13.js HTTP 301
  • https://cdn.mouseflow.com/projects/baa9b4aa-557f-4799-a97e-005e87b57d13_eu.js

101 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
onehourtaxrefund.com/
Redirect Chain
  • https://www.onehourtaxrefund.com/
  • https://onehourtaxrefund.com/
264 KB
46 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
4f3ca38abc700f1d40a78c8f5625e9ffb376f73ceea49b0be4f09b58a331bb99

Request headers

Host
onehourtaxrefund.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:23 GMT
Content-Type
text/html; charset=UTF-8
Content-Encoding
gzip
Vary
Accept-Encoding
X-Varnish
2917338 852638
Age
0
X-Cache
HIT
X-Cache-Hits
1
Accept-Ranges
bytes
Content-Length
46740
Connection
keep-alive

Redirect headers

Date
Mon, 15 Mar 2021 19:30:22 GMT
X-Redirect-By
WordPress
Location
https://onehourtaxrefund.com/
Content-Length
0
Content-Type
text/html; charset=UTF-8
X-Varnish
2097755 852635
Age
1
X-Cache
HIT
X-Cache-Hits
1
Connection
keep-alive
base.css
onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/landing-page/templates/css/ 		704 B
665 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/landing-page/templates/css/base.css?ver=2.6.7.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
d16400e6b2166cf4a5b37b2216cde40c8637e6693cf623abbee9f8cd21a7dc33

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:29:54 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:44:19 GMT
Age
30
ETag
W/"1ee58aa-2c0-5bd62d4d92ac0"
Vary
Accept-Encoding
X-Cache
HIT
X-Varnish
2917339 328789
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/css
Content-Length
321
X-Cache-Hits
1
style-rtl.min.css
onehourtaxrefund.com/wp-includes/css/dist/block-library/ 		52 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/css/dist/block-library/style-rtl.min.css?ver=5.5.3
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
cc2d402072f792fd75a519a7994a0427991afa072302b404841e31861764d5a9

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Wed, 02 Sep 2020 03:45:04 GMT
Age
0
ETag
W/"5025f2-d1e6-5ae4c75ffd000"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2917340
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/css
thrive_flat.css
onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/editor/css/ 		939 KB
92 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/editor/css/thrive_flat.css?ver=2.6.7.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
ff8d50ef4f9407e026f4b1c12eaafa344900ec9df94f39df65a3cc1c968a4d57

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:44:11 GMT
Age
0
ETag
W/"1dad49b-eaba4-5bd62d45f18c0"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2097757
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/css
landingpage-inner-frame.css
onehourtaxrefund.com/wp-content/themes/thrive-theme/inc/assets/dist/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/themes/thrive-theme/inc/assets/dist/landingpage-inner-frame.css?ver=1.8.2.2
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
a54e7ed25533c1da7605ccccc232e036b1ba398ff110ed497bff803db3c49322

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:29:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Oct 2020 11:00:08 GMT
Age
30
ETag
W/"50193e-10df-5b218224d3e00"
Vary
Accept-Encoding
X-Cache
HIT
X-Varnish
2785759 328791
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/css
Content-Length
1176
X-Cache-Hits
1
style.css
onehourtaxrefund.com/wp-content/themes/thrive-theme/ 		122 KB
21 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/themes/thrive-theme/style.css?ver=1.8.2.2
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
9316527b46b0a79da0d9f3645bf09aa841adc9fbd1a97819b81e8609290e8173

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Oct 2020 11:00:08 GMT
Age
0
ETag
W/"29b21c-1e832-5b218224d3e00"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
852640
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/css
checkout.css
onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/css/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/css/checkout.css?ver=2.3.9.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
692f6f364bbd9accd6866c67deb823580f463e1b7ea1fc81071abc2d5015ad26

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:42:48 GMT
Age
0
ETag
W/"dae4d3-e64-5bd62cf6c9e00"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
656163
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/css
logout_message.css
onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/css/ 		922 B
776 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/css/logout_message.css?ver=2.3.9.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
b77da047f8b3e770067992850b1c0b23b09ebe279ed9560d4582a96a60a55e36

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:42:48 GMT
Age
0
ETag
W/"daef66-39a-5bd62cf6c9e00"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2753111
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/css
style.css
onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/tcb-bridge/assets/css/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/tcb-bridge/assets/css/style.css?ver=2.6.7.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
886d60dd8f50634a407f7df224d23371945d12a89f7bd85b181711f6751dad25

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:42:50 GMT
Age
0
ETag
W/"144476b-187e-5bd62cf8b2280"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2917342
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/css
header.min.js
onehourtaxrefund.com/wp-content/plugins/thrive-headline-optimizer/frontend/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-headline-optimizer/frontend/js/header.min.js?ver=1.3.7.3
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
4b79016f8c4134f65a4664d94eddabce32c04ad5b49b0fb1c161e756076c881a

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:43:11 GMT
Age
0
ETag
W/"16baa53-9cf-5bd62d0cb91c0"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
656165
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
jquery.js
onehourtaxrefund.com/wp-includes/js/jquery/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:29:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Apr 2020 03:41:22 GMT
Age
30
ETag
W/"50278c-17a69-5a2ab2840dc80"
Vary
Accept-Encoding
X-Cache
HIT
X-Varnish
2753113 131793
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
33804
X-Cache-Hits
1
moxie.min.js
onehourtaxrefund.com/wp-includes/js/plupload/ 		86 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/plupload/moxie.min.js?ver=1.3.5
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
ea8f6fb79fa2083c0b68b0a618446767c7bdf2d6aafc07d54a1c80e06a838c1c

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Apr 2020 03:41:23 GMT
Age
0
ETag
W/"5027d6-1582c-5a2ab28501ec0"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2917344
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
plupload.min.js
onehourtaxrefund.com/wp-includes/js/plupload/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/plupload/plupload.min.js?ver=2.1.9
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
1985f2d29e27f6c8a54b740b8b384fab214215c090e16d6652295e4911db0fdd

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Apr 2020 03:41:23 GMT
Age
0
ETag
W/"5027d9-3d2a-5a2ab28501ec0"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2785762
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
tva-menu-item-messages.min.js
onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/js/dist/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/js/dist/tva-menu-item-messages.min.js?ver=2.3.9.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
b98ab5bb73706f94fc2256ea44dec015c8ba7ae790c735b39e1b51307c7b6656

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:42:48 GMT
Age
0
ETag
W/"1446a62-8cd-5bd62cf6c9e00"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
852642
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
rtl.css
onehourtaxrefund.com/wp-content/themes/thrive-theme/ 		370 B
611 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/themes/thrive-theme/rtl.css
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
c7161705c3ba9d4cfb3a067e16fd77f402b04fff3bb91cecdcc911cd4d7f1370

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Oct 2020 11:00:08 GMT
Age
0
ETag
W/"29b217-172-5b218224d3e00"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2785760
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
text/css
css
fonts.googleapis.com/ 		16 KB
810 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Muli:400,600,300,800,700,200,900,400i,900i,600i,500,300i,500i,800i,700i,200i&subset=latin&display=swap
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
4373a7c880f00a8373da62d923fdb65d84317ae8755e8a66b48e098b29adf53f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 15 Mar 2021 19:30:26 GMT
server
ESF
date
Mon, 15 Mar 2021 19:30:26 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 15 Mar 2021 19:30:26 GMT
wp-emoji-release.min.js
onehourtaxrefund.com/wp-includes/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/wp-emoji-release.min.js?ver=5.5.3
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:25 GMT
Content-Encoding
gzip
Last-Modified
Sat, 29 Aug 2020 19:40:13 GMT
Age
0
ETag
W/"5026e4-37a6-5ae0956844140"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2917348
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Copy-of-Colorful-Bookstore-Logo.png
mlszglajsdf2.i.optimole.com/VndG0Xw-n-blPd3W/w:auto/h:auto/q:auto/https://onehourtaxrefund.com/wp-content/uploads/2020/04/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mlszglajsdf2.i.optimole.com/VndG0Xw-n-blPd3W/w:auto/h:auto/q:auto/https://onehourtaxrefund.com/wp-content/uploads/2020/04/Copy-of-Colorful-Bookstore-Logo.png
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:9200:2:6f7a:6f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Optimole /
Resource Hash
4f92e39ce2fc824adc5bd2d7516a76dd3148e787273d54f07163394490a69364

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 12 Mar 2021 09:18:15 GMT
via
1.1 0434556f8ccac61e8735f7c75767727c.cloudfront.net (CloudFront)
age
295931
x-cache
Hit from cloudfront
content-ex-length
5923
content-disposition
inline; filename="Copy-of-Colorful-Bookstore-Logo.webp"
exec-time
59.747444ms
content-length
2980
x-request-id
hJor3aLGxRW6L7TVldFvF
server
Optimole
etag
205a13bcb24c3dec5370f7f0bb1b88064a00a1cfe7595dca336fa1f36b960f2e
vary
Accept
access-control-allow-methods
GET, OPTIONS
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000, public
x-amz-cf-pop
FRA56-C2
x-amz-cf-id
f-f5XFD40OySznVR9BSCMyE6sTf6TwfDlK4y7s0ZD1YgRLI_rl00fg==
expires
Sat, 12 Mar 2022 09:18:15 GMT
triggers.min.js
onehourtaxrefund.com/wp-content/plugins/thrive-headline-optimizer/frontend/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-headline-optimizer/frontend/js/triggers.min.js?ver=1.3.7.3
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
92a55b1575d5572543d804cf2cdcd4f59b23d30f7543b65c1d9e2a1ce72cd4ac

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:43:11 GMT
Age
0
ETag
W/"16baa54-11e0-5bd62d0cb91c0"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
852644
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
imagesloaded.min.js
onehourtaxrefund.com/wp-includes/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:24 GMT
Content-Encoding
gzip
Last-Modified
Sat, 29 Aug 2020 19:40:13 GMT
Age
0
ETag
W/"5026b7-15fd-5ae0956844140"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2753114
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
masonry.min.js
onehourtaxrefund.com/wp-includes/js/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/masonry.min.js?ver=4.2.2
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:25 GMT
Content-Encoding
gzip
Last-Modified
Sat, 29 Aug 2020 19:40:13 GMT
Age
0
ETag
W/"5026ba-5e4a-5ae0956844140"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2753116
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
jquery.masonry.min.js
onehourtaxrefund.com/wp-includes/js/jquery/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/jquery/jquery.masonry.min.js?ver=3.1.2b
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
c2e606e1fc82ea3a554aad5d0520e25d2677b89a891dc5c49e7ace08fce92e25

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:29:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Apr 2020 03:41:22 GMT
Age
30
ETag
W/"50278d-71b-5a2ab2840dc80"
Vary
Accept-Encoding
X-Cache
HIT
X-Varnish
2097759 328794
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
716
X-Cache-Hits
1
frontend.min.js
onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/editor/js/dist/ 		274 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/editor/js/dist/frontend.min.js?ver=2.6.7.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
df9c5d1cbac3bf49d0a84988e62645b7eec7353e4843e1a4384f9bf4beddf4b2

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:25 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:44:11 GMT
Age
0
ETag
W/"257db15-446fd-5bd62d45f18c0"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
1901392
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
frontend.min.js
onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/thrive-dashboard/js/dist/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/thrive-dashboard/js/dist/frontend.min.js?ver=2.3.9.3
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
9a8d4f55a83aa4e1f884930f204914da68bd3f34cb4a66b8337b032f2ebabafc

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:25 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:44:14 GMT
Age
0
ETag
W/"2c8eefa-b69-5bd62d48cdf80"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2785764
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
core.min.js
onehourtaxrefund.com/wp-includes/js/jquery/ui/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/jquery/ui/core.min.js?ver=1.11.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:29:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Apr 2020 03:41:22 GMT
Age
30
ETag
W/"50279a-f5b-5a2ab2840dc80"
Vary
Accept-Encoding
X-Cache
HIT
X-Varnish
2917346 328796
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
1813
X-Cache-Hits
1
widget.min.js
onehourtaxrefund.com/wp-includes/js/jquery/ui/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/jquery/ui/widget.min.js?ver=1.11.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
2cd83d5a29914ad4797748d8e80fbc42c2131fbce9bbcdf2749a275fc7db875f

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:29:55 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Apr 2020 03:41:22 GMT
Age
30
ETag
W/"5027bb-1ab6-5a2ab2840dc80"
Vary
Accept-Encoding
X-Cache
HIT
X-Varnish
2359719 852604
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
2559
X-Cache-Hits
1
mouse.min.js
onehourtaxrefund.com/wp-includes/js/jquery/ui/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/jquery/ui/mouse.min.js?ver=1.11.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
c04837b935b6d1fac0cbffc4a53bf19a6d89029742dbc4c8ad001c1078f5f957

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:29:55 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Apr 2020 03:41:22 GMT
Age
29
ETag
W/"5027b0-c46-5a2ab2840dc80"
Vary
Accept-Encoding
X-Cache
HIT
X-Varnish
2917347 590792
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
992
X-Cache-Hits
1
resizable.min.js
onehourtaxrefund.com/wp-includes/js/jquery/ui/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/jquery/ui/resizable.min.js?ver=1.11.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
c92c6a06a05ebbc74655d4d596a2e169f97f1ad070ee073e4024106654441a7c

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:29:55 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Apr 2020 03:41:23 GMT
Age
29
ETag
W/"5027b3-47e3-5a2ab28501ec0"
Vary
Accept-Encoding
X-Cache
HIT
X-Varnish
2753118 328800
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
Content-Length
5220
X-Cache-Hits
1
frontend.min.js
onehourtaxrefund.com/wp-content/themes/thrive-theme/inc/assets/dist/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/themes/thrive-theme/inc/assets/dist/frontend.min.js?ver=1.8.2.2
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
9b3a1ca5b842a838490b420e8551c6e963ad583b28b4502204fa3c23989800ea

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:25 GMT
Content-Encoding
gzip
Last-Modified
Tue, 20 Oct 2020 11:00:08 GMT
Age
0
ETag
W/"50193d-3da6-5b218224d3e00"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2359720
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
tva-tcb-frontend.min.js
onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/tcb-bridge/assets/js/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-content/plugins/thrive-apprentice/tcb-bridge/assets/js/tva-tcb-frontend.min.js?ver=2.3.9.4
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
99400c60d24af70b28c9d71fa064601f9a83c521ff71763b8a3539cc9e8b174f

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:25 GMT
Content-Encoding
gzip
Last-Modified
Sat, 13 Mar 2021 03:42:50 GMT
Age
0
ETag
W/"1444779-2749-5bd62cf8b2280"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2097760
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
wp-embed.min.js
onehourtaxrefund.com/wp-includes/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://onehourtaxrefund.com/wp-includes/js/wp-embed.min.js?ver=5.5.3
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.46.236.38 Frankfurt am Main, Germany, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
depro16.fcomet.com
Software
/
Resource Hash
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 15 Mar 2021 19:30:25 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Apr 2020 03:41:22 GMT
Age
0
ETag
W/"5026e1-59a-5a2ab2840dc80"
Vary
Accept-Encoding
X-Cache
MISS
X-Varnish
2785766
Transfer-Encoding
chunked
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/javascript
optimole_lib_no_poly.min.js
d5jmkjjpb7yfg.cloudfront.net/v2/latest/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d5jmkjjpb7yfg.cloudfront.net/v2/latest/optimole_lib_no_poly.min.js
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2182:7400:11:20a2:4300:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c190efeaa9963a337c7927bd5fd6f35b706b5811c213531ef77a7d81badd563f

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 09 Feb 2021 10:25:00 GMT
content-encoding
gzip
last-modified
Tue, 05 Jan 2021 12:10:20 GMT
server
AmazonS3
age
2970327
etag
W/"270d5da7376f9e855bc4ce2562e239b3"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
bLSO0qwtrm73rVwmbICz6oYWI8WCtasV
via
1.1 375e9ad5042f2098d2251daf2e517c52.cloudfront.net (CloudFront)
cache-control
max-age=31536000, public
x-amz-cf-pop
DUS51-C1
content-type
application/javascript
x-amz-cf-id
MEMFQ_HbjU4s-Uc1MplpVf0M4cULgK-keOgRtA6NCmDtDugf8qiXgQ==
gtm.js
www.googletagmanager.com/ 		136 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-W38GV4L
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e6c882877a07628920766502cfd24ca9b217d89df7f742e0c3c971107ff07b50
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:26 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49085
x-xss-protection
0
last-modified
Mon, 15 Mar 2021 18:09:12 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 15 Mar 2021 19:30:26 GMT
HfLexxjJxG4
www.youtube.com/embed/ Frame 9E91 		50 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.youtube.com
:scheme
https
:path
/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://onehourtaxrefund.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://onehourtaxrefund.com/

Response headers

content-type
text/html; charset=utf-8
x-content-type-options
nosniff
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 15 Mar 2021 19:30:26 GMT
strict-transport-security
max-age=31536000
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding
br
server
ESF
x-xss-protection
0
set-cookie
YSC=9sIUIx5ugm0; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none VISITOR_INFO1_LIVE=RkymwQqY6CA; Domain=.youtube.com; Expires=Sat, 11-Sep-2021 19:30:26 GMT; Path=/; Secure; HttpOnly; SameSite=none CONSENT=PENDING+786; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
inZeHNs4Zs0
www.youtube.com/embed/ Frame 1F89 		51 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.youtube.com
:scheme
https
:path
/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://onehourtaxrefund.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://onehourtaxrefund.com/

Response headers

content-type
text/html; charset=utf-8
x-content-type-options
nosniff
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 15 Mar 2021 19:30:26 GMT
strict-transport-security
max-age=31536000
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
content-encoding
br
server
ESF
x-xss-protection
0
set-cookie
YSC=Xz5rte4ZMlk; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none VISITOR_INFO1_LIVE=Tl7yWMyfAR8; Domain=.youtube.com; Expires=Sat, 11-Sep-2021 19:30:26 GMT; Path=/; Secure; HttpOnly; SameSite=none CONSENT=PENDING+160; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
7Auwp_0qiz-afTLGLQ.woff2
fonts.gstatic.com/s/muli/v22/ 		30 KB
31 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/muli/v22/7Auwp_0qiz-afTLGLQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli:400,600,300,800,700,200,900,400i,900i,600i,500,300i,500i,800i,700i,200i&subset=latin&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://onehourtaxrefund.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 12 Mar 2021 02:26:04 GMT
x-content-type-options
nosniff
last-modified
Wed, 15 Jul 2020 20:50:02 GMT
server
sffe
age
320662
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31120
x-xss-protection
0
expires
Sat, 12 Mar 2022 02:26:04 GMT
cover3d-434447-11.png
mlszglajsdf2.i.optimole.com/VndG0Xw-MlsnSDcz/w:491/h:395/q:eco/https://onehourtaxrefund.com/wp-content/uploads/2020/04/ 		403 B
717 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mlszglajsdf2.i.optimole.com/VndG0Xw-MlsnSDcz/w:491/h:395/q:eco/https://onehourtaxrefund.com/wp-content/uploads/2020/04/cover3d-434447-11.png
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:9200:2:6f7a:6f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
CloudFront /
Resource Hash
dd8e9d8081f5cb325830c568e806f6d365c8bc5f0681a082cad9c2e371a4de9d

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 12 Mar 2021 09:18:15 GMT
content-encoding
gzip
server
CloudFront
age
295931
etag
fa591690c642e1d6b0cf6f279602cd1e
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml; charset=utf-8
via
1.1 0434556f8ccac61e8735f7c75767727c.cloudfront.net (CloudFront)
cache-control
imutable, max-age=31536000
x-amz-cf-pop
FRA56-C2
x-robots-tag
noindex
link
<https://onehourtaxrefund.com/wp-content/uploads/2020/04/cover3d-434447-11.png>; rel="canonical"
content-length
266
x-amz-cf-id
W8djQPeZp-qWTB2yzbfmTM5DFCqs872FimeCmhvwEadTFD0h8F3VDQ==
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d2437ddf45aa84303d14cc4569941c1ae58e8accca92216349c1332794015c6f

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/gif
HfLexxjJxG4
www.youtube.com/embed/ Frame 9E91 		50 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/editor/js/dist/frontend.min.js?ver=2.6.7.4
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fde702eb201b4b5a6f22b1c1b98434a4c513fabb5590c3f56bbde3fede32c99f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.youtube.com
:scheme
https
:path
/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://onehourtaxrefund.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
YSC=9sIUIx5ugm0; VISITOR_INFO1_LIVE=RkymwQqY6CA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://onehourtaxrefund.com/

Response headers

content-type
text/html; charset=utf-8
x-content-type-options
nosniff
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 15 Mar 2021 19:30:26 GMT
strict-transport-security
max-age=31536000
content-encoding
br
server
ESF
x-xss-protection
0
set-cookie
CONSENT=PENDING+279; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
inZeHNs4Zs0
www.youtube.com/embed/ Frame 1F89 		50 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/editor/js/dist/frontend.min.js?ver=2.6.7.4
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0a262007bf2063bb3edff585b582790d6c52a2872813e89cd4299b8423c247af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.youtube.com
:scheme
https
:path
/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://onehourtaxrefund.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
YSC=9sIUIx5ugm0; VISITOR_INFO1_LIVE=RkymwQqY6CA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://onehourtaxrefund.com/

Response headers

content-type
text/html; charset=utf-8
x-content-type-options
nosniff
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Mon, 15 Mar 2021 19:30:26 GMT
strict-transport-security
max-age=31536000
content-encoding
br
server
ESF
x-xss-protection
0
set-cookie
CONSENT=PENDING+316; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
453031223
player.vimeo.com/video/ Frame B322 		15 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://player.vimeo.com/video/453031223?color=ffffff&portrait=0&title=0&byline=0&badge=0&autoplay=0&loop=0
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/wp-content/plugins/thrive-visual-editor/editor/js/dist/frontend.min.js?ver=2.6.7.4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
775f899c73c449a52853601201b194521a5851cd40a01b6f5ea162b90b22d91f
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' blob: resource: https://f.vimeocdn.com https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://f.vimeocdn.com; style-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://f.vimeocdn.com; connect-src 'self' ws: wss: https://vimeo.com https://vimeo.dev https://api.vimeo.com https://api.vimeo.dev https://*.ci.vimeows.com https://csi.gstatic.com https://fresnel.vimeocdn.com https://fresnel-player-staging.vimeows.com https://player-telemetry.vimeo.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://netflux.cloud.vimeo.com https://lic.staging.drmtoday.com https://lic.drmtoday.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://sentry.io https://*.ingest.sentry.io https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://backend.dna-delivery.com https://mimir.cloud.vimeo.com; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; default-src 'none'; img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://player.vimeo.com https://*.ci.vimeows.com https://f.vimeocdn.com; frame-src 'self' https://imasdk.googleapis.com/ https://f.vimeocdn.com; report-uri /_csp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
player.vimeo.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://onehourtaxrefund.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://onehourtaxrefund.com/

Response headers

Connection
keep-alive
Content-Length
5159
Server
nginx
Content-Type
text/html; charset=UTF-8
X-Xss-Protection
1; mode=block
Content-Security-Policy
script-src 'self' 'unsafe-inline' blob: resource: https://f.vimeocdn.com https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://f.vimeocdn.com; style-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://f.vimeocdn.com; connect-src 'self' ws: wss: https://vimeo.com https://vimeo.dev https://api.vimeo.com https://api.vimeo.dev https://*.ci.vimeows.com https://csi.gstatic.com https://fresnel.vimeocdn.com https://fresnel-player-staging.vimeows.com https://player-telemetry.vimeo.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://netflux.cloud.vimeo.com https://lic.staging.drmtoday.com https://lic.drmtoday.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://sentry.io https://*.ingest.sentry.io https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://backend.dna-delivery.com https://mimir.cloud.vimeo.com; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; default-src 'none'; img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://player.vimeo.com https://*.ci.vimeows.com https://f.vimeocdn.com; frame-src 'self' https://imasdk.googleapis.com/ https://f.vimeocdn.com; report-uri /_csp
X-Content-Type-Options
nosniff
Content-Encoding
gzip
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Link
<https://i.vimeocdn.com>; rel=preconnect; crossorigin <https://f.vimeocdn.com>; rel=preconnect; crossorigin <https://fresnel.vimeocdn.com>; rel=preconnect; crossorigin
P3p
CP="This is not a P3P policy! See https://vimeo.com/privacy"
Expires
Mon, 15 Mar 2021 19:40:26 GMT
Via
1.1 varnish, 1.1 varnish
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-Varnish-Cache
0
X-VServer
infra-playproxy-a-20
X-Vimeo-DC
ge
Accept-Ranges
bytes
Date
Mon, 15 Mar 2021 19:30:26 GMT
Age
0
X-Served-By
cache-fra19145-FRA
X-Cache
MISS
X-Cache-Hits
0
X-Timer
S1615836627.687901,VS0,VE156
Vary
Accept-Encoding
X-Player-Backend
p
analytics.js
www.google-analytics.com/ 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W38GV4L
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 05 Feb 2021 21:33:27 GMT
server
Golfe2
age
5271
date
Mon, 15 Mar 2021 18:02:35 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18980
expires
Mon, 15 Mar 2021 20:02:35 GMT
baa9b4aa-557f-4799-a97e-005e87b57d13_eu.js
cdn.mouseflow.com/projects/
Redirect Chain
  • https://cdn.mouseflow.com/projects/baa9b4aa-557f-4799-a97e-005e87b57d13.js
  • https://cdn.mouseflow.com/projects/baa9b4aa-557f-4799-a97e-005e87b57d13_eu.js
168 KB
56 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.mouseflow.com/projects/baa9b4aa-557f-4799-a97e-005e87b57d13_eu.js
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.9.38 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
110208204c86d8f65bd5be507cc9abed5a65d499c4c9c9a1fffb53ef11046c1c

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:26 GMT
content-encoding
gzip
last-modified
Sat, 13 Mar 2021 18:53:25 GMT
server
NetDNA-cache/2.2
etag
W/"a11c45263a18d71:0"
x-cache
HIT
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=86400

Redirect headers

location
https://cdn.mouseflow.com/projects/baa9b4aa-557f-4799-a97e-005e87b57d13_eu.js
date
Mon, 15 Mar 2021 19:30:26 GMT
server
NetDNA-cache/2.2
access-control-allow-origin
*
content-length
178
content-type
text/html
conversion_async.js
www.googleadservices.com/pagead/ 		32 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W38GV4L
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
7976fe07c313417d11a0d2a8c6adc40090cf1e70f51c2aef5625fe9411074276
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12596
x-xss-protection
0
server
cafe
etag
18027669630893838856
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 15 Mar 2021 19:30:26 GMT
fbevents.js
connect.facebook.net/en_US/ 		91 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
23762
x-fb-rlafr
0
pragma
public
x-fb-debug
22TrBrj3dE38WwoXyt4OMGKH0C2jMwECARP8vTlmAWwG7qApt0rNx3+5SD1We09Js4tcKXALrqLDfcRH3iCuPA==
x-fb-trip-id
917726464
x-frame-options
DENY
date
Mon, 15 Mar 2021 19:30:26 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
track.js
cdn.funnelytics.io/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.funnelytics.io/track.js
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.58.103 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bda277a4ba0af74a71829d0503828c4f976d0c56187bf9dfb4f7c017d99179d2

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 14 Mar 2021 21:46:53 GMT
content-encoding
gzip
last-modified
Tue, 08 Dec 2020 16:42:53 GMT
server
AmazonS3
age
78214
etag
W/"4ae1baef1263c1a5a4d1b46c51016daa"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 14b10bd09a0531ef477d0a404ca26900.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
ibx_OcBW_J0RmLvvgPFkz49eMxXEIUxlRbonwMLmw_rosZj-KpjsKg==
diffuser.js
diffuser-cdn.app-us1.com/diffuser/ 		24 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:925b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
07ef661be38be006eb690a15613c557d418b8780900ff490545bb2b75d23fcd7

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:26 GMT
content-encoding
gzip
cf-cache-status
HIT
age
101
x-cache
Hit from cloudfront
cf-request-id
08d8f7576f00004e082f30c000000001
last-modified
Mon, 22 Feb 2021 18:41:52 GMT
server
cloudflare
etag
W/"1e16152334c325a4abb81f1a8ee52e51"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 6b4954a8411e7b2a232537f8000c5c9d.cloudfront.net (CloudFront)
cache-control
public, max-age=300
x-amz-cf-pop
FRA50-C1
cf-ray
630828057f2d4e08-FRA
x-amz-cf-id
jRrH8l_r-Z55cv8vP872dccZfETLBl7IwHRG4WSF-4Iv0j3x8EZlDg==
cover3d-434447-11.png
mlszglajsdf2.i.optimole.com/VndG0Xw-MlsnSDcz/w:491/h:395/q:auto/https://onehourtaxrefund.com/wp-content/uploads/2020/04/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mlszglajsdf2.i.optimole.com/VndG0Xw-MlsnSDcz/w:491/h:395/q:auto/https://onehourtaxrefund.com/wp-content/uploads/2020/04/cover3d-434447-11.png
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:211e:9200:2:6f7a:6f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Optimole /
Resource Hash
6262aff5f8247d62534a71c376656582b656f7561ccb44638ecb33be1a7632b4

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 12 Mar 2021 09:18:55 GMT
via
1.1 0434556f8ccac61e8735f7c75767727c.cloudfront.net (CloudFront)
age
295891
x-cache
Hit from cloudfront
content-ex-length
157832
content-disposition
inline; filename="cover3d-434447-11.webp"
exec-time
229.216096ms
content-length
21120
x-request-id
8GpdQYLq70YXz9_LHZhnc
server
Optimole
etag
9d0297275c2a85cf7b21519016a186c1ac392c425d271f40d13e8f061c58a33a
vary
Accept
access-control-allow-methods
GET, OPTIONS
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000, public
x-amz-cf-pop
FRA56-C2
x-amz-cf-id
L3IZUP65Fwz9xtl_x11enw-y84d8XyQQl6YCmbvVIZ08rPhBidTckg==
expires
Sat, 12 Mar 2022 09:18:55 GMT
www-player-webp.css
www.youtube.com/s/player/d29f3109/ Frame 9E91 		341 KB
51 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/www-player-webp.css
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4f3d44464550faae5daa4a090d801ef80ffb455b2c82e9a41b2864b1b5edc7c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Mar 2021 15:45:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
359075
vary
Accept-Encoding, Origin
content-type
text/css
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52229
x-xss-protection
0
expires
Fri, 11 Mar 2022 15:45:51 GMT
www-embed-player.js
www.youtube.com/s/player/d29f3109/www-embed-player.vflset/ Frame 9E91 		160 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/www-embed-player.vflset/www-embed-player.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
03aef28a1ff1337c859cab5bdf6f0557e940c6f7c82c8d00502bd46b2fde91fc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 07:43:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
42393
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
59121
x-xss-protection
0
expires
Tue, 15 Mar 2022 07:43:53 GMT
base.js
www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/ Frame 9E91 		2 MB
504 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
19151ee5527abc4a3250857bd09c35b181c2edc42979771d29fee1eaf3b012bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 14 Mar 2021 14:43:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
103634
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
516037
x-xss-protection
0
expires
Mon, 14 Mar 2022 14:43:12 GMT
fetch-polyfill.js
www.youtube.com/s/player/d29f3109/fetch-polyfill.vflset/ Frame 9E91 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/fetch-polyfill.vflset/fetch-polyfill.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 11:50:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
27585
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3027
x-xss-protection
0
expires
Tue, 15 Mar 2022 11:50:41 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 9E91 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.youtube.com
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Mar 2021 19:41:25 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
age
344941
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
expires
Fri, 11 Mar 2022 19:41:25 GMT
www-player-webp.css
www.youtube.com/s/player/d29f3109/ Frame 1F89 		341 KB
51 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/www-player-webp.css
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4f3d44464550faae5daa4a090d801ef80ffb455b2c82e9a41b2864b1b5edc7c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Mar 2021 15:45:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
359075
vary
Accept-Encoding, Origin
content-type
text/css
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
52229
x-xss-protection
0
expires
Fri, 11 Mar 2022 15:45:51 GMT
www-embed-player.js
www.youtube.com/s/player/d29f3109/www-embed-player.vflset/ Frame 1F89 		160 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/www-embed-player.vflset/www-embed-player.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
03aef28a1ff1337c859cab5bdf6f0557e940c6f7c82c8d00502bd46b2fde91fc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 07:43:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
42393
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
59121
x-xss-protection
0
expires
Tue, 15 Mar 2022 07:43:53 GMT
base.js
www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/ Frame 1F89 		2 MB
504 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
19151ee5527abc4a3250857bd09c35b181c2edc42979771d29fee1eaf3b012bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 14 Mar 2021 14:43:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
103634
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
516037
x-xss-protection
0
expires
Mon, 14 Mar 2022 14:43:12 GMT
fetch-polyfill.js
www.youtube.com/s/player/d29f3109/fetch-polyfill.vflset/ Frame 1F89 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/fetch-polyfill.vflset/fetch-polyfill.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 11:50:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
27585
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3027
x-xss-protection
0
expires
Tue, 15 Mar 2022 11:50:41 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 1F89 		15 KB
15 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.youtube.com
Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Mar 2021 19:41:25 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
age
344941
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
expires
Fri, 11 Mar 2022 19:41:25 GMT
collect
www.google-analytics.com/j/ 		2 B
88 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j88&a=722515362&t=pageview&_s=1&dl=https%3A%2F%2Fonehourtaxrefund.com%2F&ul=en-us&de=UTF-8&dt=%D7%AA%D7%95%D7%9B%D7%A0%D7%99%D7%AA%20%D7%94%D7%93%D7%A8%D7%9B%D7%94%20%D7%9C%D7%A9%D7%9B%D7%99%D7%A8%D7%99%D7%9D%20%E2%80%93%20%D7%94%D7%97%D7%96%D7%A8%20%D7%9E%D7%A1%20-%20One%20Hour%20Tax%20Refund&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1270984140&gjid=132048846&cid=1891485176.1615836627&tid=UA-151761357-2&_gid=179384848.1615836627&_r=1&gtm=2wg330W38GV4L&tc=x&z=1074253365
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 15 Mar 2021 19:30:26 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://onehourtaxrefund.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
646690565682296
connect.facebook.net/signals/config/ 		242 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/646690565682296?v=2.9.33&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
74f05793fca1bac5837ddc7e97c2493154e66aa1d93515458a61b2f271f5af5e
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr
0
pragma
public
x-fb-debug
drCkQozXXWLwAqLr3W4yWsfb6+/1/5uLG7c0u+g27QffcISeZhk8vgyGt+yL1LBBc9P9GbBMpcaEUpHeqE2YJQ==
x-fb-trip-id
917726464
x-frame-options
DENY
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Mon, 15 Mar 2021 19:30:26 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
cross-origin-opener-policy-report-only
same-origin-allow-popups;report-to="coop_report"
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
91 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-151761357-2&cid=1891485176.1615836627&jid=1270984140&gjid=132048846&_gid=179384848.1615836627&_u=YEBAAEAAAAAAAC~&z=1283300352
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c09::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Mon, 15 Mar 2021 19:30:26 GMT
content-type
text/plain
access-control-allow-origin
https://onehourtaxrefund.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
sessions
track-v2.funnelytics.io/ 		50 B
261 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://track-v2.funnelytics.io/sessions
Requested by
Host: cdn.funnelytics.io
URL: https://cdn.funnelytics.io/track.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.97.87.100 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-97-87-100.ca-central-1.compute.amazonaws.com
Software
/
Resource Hash
197c866fca7bc7ae09cfe133d73fee44018b3e6ba123efad800be1cef0c2e526

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
date
Mon, 15 Mar 2021 19:30:27 GMT
x-amzn-requestid
47db750e-ca98-4eec-ab0c-5733f8f586e6
x-amz-apigw-id
cPlZBHb34osFmhA=
x-amzn-trace-id
Root=1-604fb5d3-1fd0f197006d06f9329b2e6f;Sampled=0
content-length
50
content-type
application/json
/
prism.app-us1.com/ 		249 B
415 B 		Script
General
Check archive.org
Download Go to
Full URL
https://prism.app-us1.com/?a=66901272&u=https%3A%2F%2Fonehourtaxrefund.com%2F
Requested by
Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:925b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.2.34
Resource Hash
ec7204b14a4c04d683b91fc4b1a6d855a09d43cb3a705e30a191048f4cd3e179

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
x-powered-by
PHP/7.2.34
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
application/javascript
cache-control
no-cache, private
cf-ray
6308280678c84e08-FRA
cf-request-id
08d8f7580a00004e087916c000000001
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/636375401/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/636375401/?random=1615836626963&cv=9&fst=1615836626963&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg330&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fonehourtaxrefund.com%2F&tiba=%D7%AA%D7%95%D7%9B%D7%A0%D7%99%D7%AA%20%D7%94%D7%93%D7%A8%D7%9B%D7%94%20%D7%9C%D7%A9%D7%9B%D7%99%D7%A8%D7%99%D7%9D%20%E2%80%93%20%D7%94%D7%97%D7%96%D7%A8%20%D7%9E%D7%A1%20-%20One%20Hour%20Tax%20Refund&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2aeba6d48276f4c4d1b9f924f313c33842aed1fb015201a21e4d27f98d463117
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 15 Mar 2021 19:30:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1070
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
114 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-151761357-2&cid=1891485176.1615836627&jid=1270984140&_u=YEBAAEAAAAAAAC~&z=1807069503
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 15 Mar 2021 19:30:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-151761357-2&cid=1891485176.1615836627&jid=1270984140&_u=YEBAAEAAAAAAAC~&z=1807069503
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 15 Mar 2021 19:30:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
949043369.jpg
i.vimeocdn.com/video/ Frame B322 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.vimeocdn.com/video/949043369.jpg?mw=80&q=85
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/453031223?color=ffffff&portrait=0&title=0&byline=0&badge=0&autoplay=0&loop=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
7fb131a692a953d5607dc88a166547b4102e83014086e989db8e57a71903a4ee

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
via
vvarnish, 1.1 varnish, 1.1 varnish
age
970676
etag
c0a952a843f5d4266f9fb4e70df0ed30
x-served-by
cache-dfw18624-DFW, cache-hhn4036-HHN
x-cache
miss, HIT, HIT
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
x-timer
S1615836627.083764,VS0,VE1
x-backend-server
varnish
content-length
2015
viewmaster-server
viewmaster-us-central1-6f7b
x-cache-hits
1, 1
player.js
f.vimeocdn.com/p/3.24.17/js/ Frame B322 		612 KB
144 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://f.vimeocdn.com/p/3.24.17/js/player.js
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/453031223?color=ffffff&portrait=0&title=0&byline=0&badge=0&autoplay=0&loop=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
199dd00b539a14db6dabe80e285db52e3dcaaf129ff7cc282f39eba7e5f777f4

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
via
1.1 varnish, 1.1 varnish
age
865018
x-guploader-uploadid
ABg5-UwQUOPcJJxZ3phwp7BP3L1D0dNOPs_-H5DbkNPE81sY1hsUNeW0cBCK9FMTsL25lY_295IDW8BVqBjQHx4NVjNalyN24A
x-cache
MISS, HIT
content-encoding
br
content-length
147458
x-served-by
cache-bwi5157-BWI, cache-hhn4071-HHN
last-modified
Fri, 05 Mar 2021 17:54:32 GMT
server
UploadServer
x-timer
S1615836627.083442,VS0,VE0
etag
"cf8eea28b20d00c89836662b7978e650"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1209600
accept-ranges
bytes
x-cache-hits
0, 415903
player.css
f.vimeocdn.com/p/3.24.17/css/ Frame B322 		159 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://f.vimeocdn.com/p/3.24.17/css/player.css
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/453031223?color=ffffff&portrait=0&title=0&byline=0&badge=0&autoplay=0&loop=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
UploadServer /
Resource Hash
6b6b4128d463875ca45df804c0c952487c94745bce3430cd0d05d92c588df58e

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
via
1.1 varnish, 1.1 varnish
age
865021
x-guploader-uploadid
ABg5-Uz1fZe6t6xaKPJqi-6o2ym2-Ome4ttl_TCGciwbyl3oMcXquv0Al5w0PdMx0GVg98UfO7q45rhiHL83AmfaoQ_Pzc6W7g
x-cache
MISS, HIT
content-encoding
br
content-length
17422
x-served-by
cache-bwi5158-BWI, cache-hhn4071-HHN
last-modified
Fri, 05 Mar 2021 17:54:33 GMT
server
UploadServer
x-timer
S1615836627.082711,VS0,VE0
etag
"1b221a32a53bd052faa1978e63d43ae6"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=1209600
accept-ranges
bytes
x-cache-hits
0, 808089
vuid.min.js
f.vimeocdn.com/js_opt/modules/utils/ Frame B322 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://f.vimeocdn.com/js_opt/modules/utils/vuid.min.js
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/453031223?color=ffffff&portrait=0&title=0&byline=0&badge=0&autoplay=0&loop=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
d7d00e88ba46fbfafd5c03c54553c1146fd850e7128fc85ae6d6e52b171837f4

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
content-encoding
gzip
age
6246403
x-cache
HIT, HIT
x-cache-hits
1, 1840926
content-length
1238
x-served-by
cache-bwi5125-BWI, cache-hhn4071-HHN
last-modified
Fri, 18 Dec 2020 02:46:33 GMT
server
Apache
cache-control
max-age=315360000
x-timer
S1615836627.083424,VS0,VE0
etag
"a68-5b6b41dbf5440"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
via
1.1 varnish, 1.1 varnish
x-vimeo-dc
ge
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 31 Dec 2030 12:23:44 GMT
id
googleads.g.doubleclick.net/pagead/ Frame 9E91 		113 B
921 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/id
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/www-embed-player.vflset/www-embed-player.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4ae50e7e1ee7acdb1736efc4b6c497f90c1f4346957a605a71eaad9c41f14822
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
133
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad_status.js
static.doubleclick.net/instream/ Frame 9E91 		29 B
407 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.doubleclick.net/instream/ad_status.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/www-embed-player.vflset/www-embed-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:18:07 GMT
x-content-type-options
nosniff
last-modified
Thu, 12 Dec 2013 23:40:16 GMT
server
sffe
age
740
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29
x-xss-protection
0
expires
Mon, 15 Mar 2021 19:33:07 GMT
id
googleads.g.doubleclick.net/pagead/ Frame 1F89 		113 B
297 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/id
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/www-embed-player.vflset/www-embed-player.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
86d1ce0b4aa3c1bb63c3c82710f999387b45a09732aefa91f410c503fd067335
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
133
x-xss-protection
0
pragma
no-cache
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.youtube.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad_status.js
static.doubleclick.net/instream/ Frame 1F89 		29 B
394 B 		Script
General
Check archive.org
Download Go to
Full URL
https://static.doubleclick.net/instream/ad_status.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/www-embed-player.vflset/www-embed-player.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:18:07 GMT
x-content-type-options
nosniff
last-modified
Thu, 12 Dec 2013 23:40:16 GMT
server
sffe
age
740
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=900
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29
x-xss-protection
0
expires
Mon, 15 Mar 2021 19:33:07 GMT
remote.js
www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/ Frame 9E91 		97 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/remote.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a14b646dae4cb103a505b93b65be169b52a57ba39d191ee02357e473e80dca62
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 14 Mar 2021 22:06:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
77043
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32708
x-xss-protection
0
expires
Mon, 14 Mar 2022 22:06:24 GMT
OqSalp92o-4AtfYt583RauVJYevBmhjij2pcg0zPe10.js
www.google.com/js/bg/ Frame 9E91 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/bg/OqSalp92o-4AtfYt583RauVJYevBmhjij2pcg0zPe10.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3aa49a969f76a3ee00b5f62de7cdd16ae54961ebc19a18e28f6a5c834ccf7b5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 14 Mar 2021 19:38:00 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 08 Mar 2021 18:00:00 GMT
server
sffe
age
85947
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5732
x-xss-protection
0
expires
Mon, 14 Mar 2022 19:38:00 GMT
embed.js
www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/ Frame 9E91 		29 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/embed.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
24323a2bb3c6da5795183af10abe4738f2864183d6dc42af713aae3bc97c8433
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Mar 2021 15:46:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
359046
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9674
x-xss-protection
0
expires
Fri, 11 Mar 2022 15:46:21 GMT
truncated
/ Frame 9E91 		175 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
AAUvwngFyQuCfIMNIUABjIc3mUeCFaMih3CbV7FwUsE-=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 9E91 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yt3.ggpht.com/ytc/AAUvwngFyQuCfIMNIUABjIc3mUeCFaMih3CbV7FwUsE-=s68-c-k-c0x00ffffff-no-rj
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
e09840622c40edd9be95ac745b1cc69498e2baed7d0dbb3f6b494a2ad59afc2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
x-content-type-options
nosniff
server
fife
etag
"v55"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1251
x-xss-protection
0
expires
Tue, 16 Mar 2021 19:30:27 GMT
sddefault.webp
i.ytimg.com/vi_webp/HfLexxjJxG4/ Frame 9E91 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ytimg.com/vi_webp/HfLexxjJxG4/sddefault.webp
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e7e82e6951688006816988d2f7708e63dbe14d23b2b5dcba81e036ff229b134
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
x-content-type-options
nosniff
server
sffe
etag
"0"
vary
Origin
content-type
image/webp
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18222
x-xss-protection
0
expires
Mon, 15 Mar 2021 21:30:27 GMT
/
www.facebook.com/tr/ 		44 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=646690565682296&ev=PageView&dl=https%3A%2F%2Fonehourtaxrefund.com%2F&rl=&if=false&ts=1615836627273&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1615836627271.985505933&it=1615836626879&coo=false&rqm=GET
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Mon, 15 Mar 2021 19:30:27 GMT
remote.js
www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/ Frame 1F89 		97 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/remote.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a14b646dae4cb103a505b93b65be169b52a57ba39d191ee02357e473e80dca62
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 14 Mar 2021 22:06:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
77043
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
32708
x-xss-protection
0
expires
Mon, 14 Mar 2022 22:06:24 GMT
OqSalp92o-4AtfYt583RauVJYevBmhjij2pcg0zPe10.js
www.google.com/js/bg/ Frame 1F89 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/js/bg/OqSalp92o-4AtfYt583RauVJYevBmhjij2pcg0zPe10.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3aa49a969f76a3ee00b5f62de7cdd16ae54961ebc19a18e28f6a5c834ccf7b5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 14 Mar 2021 19:38:00 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Mon, 08 Mar 2021 18:00:00 GMT
server
sffe
age
85947
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5732
x-xss-protection
0
expires
Mon, 14 Mar 2022 19:38:00 GMT
embed.js
www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/ Frame 1F89 		29 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/embed.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
24323a2bb3c6da5795183af10abe4738f2864183d6dc42af713aae3bc97c8433
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Mar 2021 15:46:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Mar 2021 03:47:17 GMT
server
sffe
age
359046
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9674
x-xss-protection
0
expires
Fri, 11 Mar 2022 15:46:21 GMT
truncated
/ Frame 1F89 		175 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
AAUvwnjR-S03FyA7QNHZqh_cXtFK1RiCK0PxOZtTPx1E=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 1F89 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://yt3.ggpht.com/ytc/AAUvwnjR-S03FyA7QNHZqh_cXtFK1RiCK0PxOZtTPx1E=s68-c-k-c0x00ffffff-no-rj
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
27f3d8eee6bafcda0e234b9824cf18165118d846b59bc7390a83ce7c841ecd8c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
x-content-type-options
nosniff
server
fife
etag
"v12"
vary
Origin
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
public, max-age=86400, no-transform
content-disposition
inline;filename="unnamed.jpg"
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1817
x-xss-protection
0
expires
Tue, 16 Mar 2021 19:30:27 GMT
sddefault.webp
i.ytimg.com/vi_webp/inZeHNs4Zs0/ Frame 1F89 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ytimg.com/vi_webp/inZeHNs4Zs0/sddefault.webp
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
501a69b7aef35f4e67d21f805d01be438bd664c056ba9983f95224181bbf25e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
x-content-type-options
nosniff
server
sffe
etag
"0"
vary
Origin
content-type
image/webp
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15946
x-xss-protection
0
expires
Mon, 15 Mar 2021 21:30:27 GMT
/
www.google.com/pagead/1p-user-list/636375401/ 		42 B
119 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/636375401/?random=1615836626963&cv=9&fst=1615834800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg330&sendb=1&frm=0&url=https%3A%2F%2Fonehourtaxrefund.com%2F&tiba=%D7%AA%D7%95%D7%9B%D7%A0%D7%99%D7%AA%20%D7%94%D7%93%D7%A8%D7%9B%D7%94%20%D7%9C%D7%A9%D7%9B%D7%99%D7%A8%D7%99%D7%9D%20%E2%80%93%20%D7%94%D7%97%D7%96%D7%A8%20%D7%9E%D7%A1%20-%20One%20Hour%20Tax%20Refund&async=1&fmt=3&is_vtc=1&random=907536541&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 15 Mar 2021 19:30:27 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/636375401/ 		42 B
135 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/636375401/?random=1615836626963&cv=9&fst=1615834800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wg330&sendb=1&frm=0&url=https%3A%2F%2Fonehourtaxrefund.com%2F&tiba=%D7%AA%D7%95%D7%9B%D7%A0%D7%99%D7%AA%20%D7%94%D7%93%D7%A8%D7%9B%D7%94%20%D7%9C%D7%A9%D7%9B%D7%99%D7%A8%D7%99%D7%9D%20%E2%80%93%20%D7%94%D7%97%D7%96%D7%A8%20%D7%9E%D7%A1%20-%20One%20Hour%20Tax%20Refund&async=1&fmt=3&is_vtc=1&random=907536541&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 15 Mar 2021 19:30:27 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
vuid
vimeo.com/ablincoln/ Frame B322 		0
789 B 		Other
General
Check archive.org
Download Go to
Full URL
https://vimeo.com/ablincoln/vuid?pid=54e9be9af4eeca74fa8dfe7081cb6f6246d191bc1615836626
Requested by
Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/js_opt/modules/utils/vuid.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.64.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Via
1.1 varnish, 1.1 varnish
X-Content-Type-Options
nosniff
Content-Security-Policy-Report-Only
default-src https: data: blob: wss: 'unsafe-inline' 'unsafe-eval'; report-uri /_csp
X-Cache
MISS, MISS
Connection
keep-alive
X-XSS-Protection
1; mode=block
X-Served-By
cache-bwi5177-BWI, cache-hhn4082-HHN
X-Vimeo-DC
ge
Server
nginx
X-Timer
S1615836627.438051,VS0,VE114
X-Frame-Options
sameorigin
Date
Mon, 15 Mar 2021 19:30:27 GMT
Vary
User-Agent
Expires
Mon, 15 Mar 2021 07:30:27 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-BApp-Server
pweb-v9068-mkwvm
X-UA-Compatible
IE=edge
Accept-Ranges
bytes
X-Cache-Hits
0, 0
949043369.webp
i.vimeocdn.com/video/ Frame B322 		28 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.vimeocdn.com/video/949043369.webp?mw=700&mh=704
Requested by
Host: player.vimeo.com
URL: https://player.vimeo.com/video/453031223?color=ffffff&portrait=0&title=0&byline=0&badge=0&autoplay=0&loop=0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
93c032a2c28ceb070bdcbed147109c0136cbe323a1b951391074259bdb7a54ec

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
via
vvarnish, 1.1 varnish, 1.1 varnish
age
0
x-cache
miss, MISS, MISS
x-backend-server
varnish
content-length
28386
viewmaster-server
viewmaster-us-central1-kdsh
x-served-by
cache-dfw18672-DFW, cache-hhn4036-HHN
x-timer
S1615836627.476940,VS0,VE380
etag
d0bc288072bdd2d72b4759fec0f5a5b1
x-viewmaster-webp-format
lossy
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
x-cache-hits
0, 0
player-stats
fresnel.vimeocdn.com/add/ Frame B322 		0
110 B 		Other
General
Check archive.org
Download Go to
Full URL
https://fresnel.vimeocdn.com/add/player-stats?beacon=1&session-id=54e9be9af4eeca74fa8dfe7081cb6f6246d191bc1615836626
Requested by
Host: f.vimeocdn.com
URL: https://f.vimeocdn.com/p/3.24.17/js/player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.202.204 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
204.202.120.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://player.vimeo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

access-control-allow-origin
https://player.vimeo.com
date
Mon, 15 Mar 2021 19:30:27 GMT
via
1.1 google
access-control-allow-credentials
true
alt-svc
clear
content-length
0
cast_sender.js
www.gstatic.com/cv/js/sender/v1/ Frame 9E91 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 16 Feb 2021 23:57:06 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2007
x-xss-protection
0
expires
Mon, 15 Mar 2021 19:30:27 GMT
generate_204
www.youtube.com/ Frame 9E91 		0
38 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.youtube.com/generate_204?cbwqow
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
steps
track-v2.funnelytics.io/ 		47 B
257 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://track-v2.funnelytics.io/steps
Requested by
Host: cdn.funnelytics.io
URL: https://cdn.funnelytics.io/track.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.97.87.100 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-97-87-100.ca-central-1.compute.amazonaws.com
Software
/
Resource Hash
5d9bc27ded0505ebc49055d28fc5c42e83c40ac1953725287ee2cfa8323fe4fc

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
date
Mon, 15 Mar 2021 19:30:27 GMT
x-amzn-requestid
106fc54f-e90a-499d-a632-f7d670070476
x-amz-apigw-id
cPlZGFi_4osFgtw=
x-amzn-trace-id
Root=1-604fb5d3-27711e2b6a3b158d595a17a1;Sampled=0
content-length
47
content-type
application/json
fabc5caa-0c39-4586-8936-b9013338081d
track-v2.funnelytics.io/settings/ 		38 B
248 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://track-v2.funnelytics.io/settings/fabc5caa-0c39-4586-8936-b9013338081d
Requested by
Host: cdn.funnelytics.io
URL: https://cdn.funnelytics.io/track.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.97.87.100 Montreal, Canada, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-97-87-100.ca-central-1.compute.amazonaws.com
Software
/
Resource Hash
14f5db1f03b024cfbcc1c6e9eb0e5fa8fc658ca55bdde829bc1c14495b319cdb

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
date
Mon, 15 Mar 2021 19:30:27 GMT
x-amzn-requestid
4b464516-6370-430d-bc6a-f2ece3d7a9b4
x-amz-apigw-id
cPlZGFXNYosFmtg=
x-amzn-trace-id
Root=1-604fb5d3-7e9b46775ba8f65c1e2c9941;Sampled=0
content-length
38
content-type
application/json
cast_sender.js
www.gstatic.com/cv/js/sender/v1/ Frame 1F89 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/player_ias.vflset/en_US/base.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.youtube.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 16 Feb 2021 23:57:06 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2007
x-xss-protection
0
expires
Mon, 15 Mar 2021 19:30:27 GMT
generate_204
www.youtube.com/ Frame 1F89 		0
13 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.youtube.com/generate_204?9BB0gA
Requested by
Host: onehourtaxrefund.com
URL: https://onehourtaxrefund.com/
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:27 GMT
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
t_prism_sitemessages.php
trackcmp.net/ 		0
271 B 		Script
General
Check archive.org
Download Go to
Full URL
https://trackcmp.net/t_prism_sitemessages.php?trackid=66901272&prismid=692decaa-de2a-4eee-924d-8eb8a063220d&url=https%3A%2F%2Fonehourtaxrefund.com%2F
Requested by
Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.21.115.144 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-21-115-144.compute-1.amazonaws.com
Software
Apache/2.4.46 (Amazon) / PHP/7.1.33
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:28 GMT
server
Apache/2.4.46 (Amazon)
x-powered-by
PHP/7.1.33
p3p
CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
cache-control
no-cache, private
x-privacy-policy
You can find our privacy policy here: https://www.activecampaign.com/help/privacy-policy/
content-type
text/javascript;charset=UTF-8
content-length
0
wp-controller.js
wp-ui.app-us1.com/ 		23 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wp-ui.app-us1.com/wp-controller.js
Requested by
Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.226.159.11 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-226-159-11.dus51.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3c7f1515ef582d8c9730e046767d496baa2b27a6408245fa517e715a9409b538

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 08:25:47 GMT
via
1.1 a67be963c7536322e9a591e428e62d28.cloudfront.net (CloudFront)
etag
"c9bbc9a7fb8ba33cdf05ead14568b82f"
last-modified
Thu, 04 Mar 2021 16:39:47 GMT
server
AmazonS3
age
39884
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-pop
DUS51-C1
accept-ranges
bytes
content-length
23925
x-amz-cf-id
xBDk-4SVUec1NI_gBiXEtEwHsUN2zClWd0NskKUiRzH4B3b8BvtHZQ==
/
www.facebook.com/tr/ 		0
79 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundarypHAiIq2RGmuRTdRd

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Mon, 15 Mar 2021 19:30:27 GMT
content-type
text/plain
access-control-allow-origin
https://onehourtaxrefund.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0
personalize
personalization-wp-service.cluster.app-us1.com/ 		173 B
476 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://personalization-wp-service.cluster.app-us1.com/personalize?trackId=66901272&visitorId=692decaa-de2a-4eee-924d-8eb8a063220d&url=https://onehourtaxrefund.com/
Requested by
Host: wp-ui.app-us1.com
URL: https://wp-ui.app-us1.com/wp-controller.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.233.241.134 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-233-241-134.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
60091e00b9f0c008542e8e37137e8715fdf75f9b9b6291e697c6e1a057484fd0

Request headers

Accept
application/json
Referer
https://onehourtaxrefund.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 15 Mar 2021 19:30:28 GMT
server
istio-envoy
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
content-type
application/json
access-control-allow-origin
*
x-envoy-upstream-service-time
28
Connection
keep-alive
Content-Length
173
log_event
www.youtube.com/youtubei/v1/ Frame 9E91 		28 B
315 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/www-embed-player.vflset/www-embed-player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json
X-YouTube-Utc-Offset
60
X-YouTube-Client-Name
56
Referer
https://www.youtube.com/embed/HfLexxjJxG4?rel=0&modestbranding=1&controls=1&showinfo=1&fs=1&wmode=transparent
X-YouTube-Client-Version
1.20210310.3.0
X-YouTube-Time-Zone
Europe/Berlin
X-Goog-Visitor-Id
CgtSa3ltd1FxWTZDQSjS676CBg%3D%3D
X-YouTube-Ad-Signals
dt=1615836626947&flash=0&frm=2&u_tz=60&u_his=2&u_java&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug&u_nmime&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C608%2C342&vis=1&wgl=true&ca_type=image&bid=ANyPxKqVI9SBs51mIRBTkcvzAb9rJsGhiVBaXg3q4cueyuPYT_p5i8MKMtMUqt2koMJpz-nuCM9ZpJeovSW0L34L0onfuKBUcQ

Response headers

date
Mon, 15 Mar 2021 19:30:37 GMT
content-encoding
br
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31
x-xss-protection
0
expires
Mon, 15 Mar 2021 19:30:37 GMT
log_event
www.youtube.com/youtubei/v1/ Frame 1F89 		28 B
246 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/s/player/d29f3109/www-embed-player.vflset/www-embed-player.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json
X-YouTube-Utc-Offset
60
X-YouTube-Client-Name
56
Referer
https://www.youtube.com/embed/inZeHNs4Zs0?rel=0&modestbranding=0&controls=1&showinfo=1&fs=1&wmode=transparent
X-YouTube-Client-Version
1.20210310.3.0
X-YouTube-Time-Zone
Europe/Berlin
X-Goog-Visitor-Id
CgtSa3ltd1FxWTZDQSjS676CBg%3D%3D
X-YouTube-Ad-Signals
dt=1615836626987&flash=0&frm=2&u_tz=60&u_his=2&u_java&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug&u_nmime&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C519%2C292&vis=1&wgl=true&ca_type=image&bid=ANyPxKpQC9xZSY_fqPg8P-KlcHdz8Rvg_BnftrcHUqXDO_7-ud8mSDIIExFAEn15vaNAYWvIoi7Zzj4lVXvjaTEHSEHUB31i3Q

Response headers

date
Mon, 15 Mar 2021 19:30:37 GMT
content-encoding
br
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
vary
Origin, X-Origin, Referer
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control
private
content-type
application/json; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31
x-xss-protection
0
expires
Mon, 15 Mar 2021 19:30:37 GMT

Verdicts & Comments Add Verdict or Comment

102 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _wpemojiSettings object| THO_Head function| tho_change_titles function| tho_brute_search_replace function| tho_get_title_variation function| tho_output_title function| tho_random_key function| tho_get_cookie function| tho_set_cookie string| THO_Titles object| THO_Variations number| tho_title_interval undefined| $ function| jQuery boolean| MXI_DEBUG object| moxie object| mOxie object| o object| plupload object| optimoleData object| dataLayer function| tcbToast object| TVE_Event_Manager_Registered_Callbacks object| THO_Front object| ThriveGlobal function| EvEmitter function| imagesLoaded function| jQueryBridget function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| tve_frontend_options function| _toConsumableArray function| _nonIterableSpread function| _iterableToArray function| _arrayWithoutHoles function| ownKeys function| _objectSpread function| _possibleConstructorReturn function| _assertThisInitialized function| _get function| _superPropBase function| _getPrototypeOf function| _inherits function| _setPrototypeOf function| _classCallCheck function| _defineProperties function| _createClass function| _defineProperty function| _typeof object| TVE_jQFn object| TCB_Front function| tve_add_http function| tve_is_email function| tve_unserialize object| tve_dash_front object| TVE_Dash object| thrive_front_localize object| ThriveTheme object| wp object| tcb_post_lists object| TL_Const object| google_tag_manager object| jQuery11240009881729341492784 object| tcb_autofill number| TCB_PAGE_INDEX object| twemoji object| google_tag_data string| GoogleAnalyticsObject function| ga function| fbq function| _fbq string| visitorGlobalObjectAlias function| vgo object| gaplugins object| gaGlobal object| gaData string| prismGlobalObjectAlias object| visitorGlobalObject object| funnelytics object| cookies function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| mouseflowHeatmap object| _mfq object| mouseflow object| wpGlobalObject

7 Cookies

Domain/Path Name / Value
.vimeo.com/ Name: vuid
Value: pl659439685.1145030556
.onehourtaxrefund.com/ Name: prism_66901272
Value: 692decaa-de2a-4eee-924d-8eb8a063220d
.onehourtaxrefund.com/ Name: _ga
Value: GA1.2.1891485176.1615836627
.onehourtaxrefund.com/ Name: _fs
Value: 54ef54a8-d4fe-4103-874c-cfe7bc92bffe
.onehourtaxrefund.com/ Name: _gat_UA-151761357-2
Value: 1
.onehourtaxrefund.com/ Name: _gid
Value: GA1.2.179384848.1615836627
.onehourtaxrefund.com/ Name: _fbp
Value: fb.1.1615836627271.985505933

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.funnelytics.io
cdn.mouseflow.com
connect.facebook.net
d5jmkjjpb7yfg.cloudfront.net
diffuser-cdn.app-us1.com
f.vimeocdn.com
fonts.googleapis.com
fonts.gstatic.com
fresnel.vimeocdn.com
googleads.g.doubleclick.net
i.vimeocdn.com
i.ytimg.com
mlszglajsdf2.i.optimole.com
onehourtaxrefund.com
personalization-wp-service.cluster.app-us1.com
player.vimeo.com
prism.app-us1.com
static.doubleclick.net
stats.g.doubleclick.net
track-v2.funnelytics.io
trackcmp.net
vimeo.com
wp-ui.app-us1.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.onehourtaxrefund.com
www.youtube.com
yt3.ggpht.com
13.226.159.11
151.101.114.109
151.101.12.217
151.101.64.217
172.217.16.130
18.233.241.134
192.46.236.38
23.111.9.38
2600:9000:211e:9200:2:6f7a:6f00:93a1
2600:9000:2182:7400:11:20a2:4300:21
2606:4700::6811:925b
2a00:1450:4001:800::2003
2a00:1450:4001:800::200e
2a00:1450:4001:803::200e
2a00:1450:4001:808::2002
2a00:1450:4001:808::2006
2a00:1450:4001:809::2003
2a00:1450:4001:810::2003
2a00:1450:4001:810::2004
2a00:1450:4001:811::2003
2a00:1450:4001:813::2004
2a00:1450:4001:827::2001
2a00:1450:4001:827::2008
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::200a
2a00:1450:4001:82a::2016
2a00:1450:400c:c09::9b
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
3.97.87.100
34.120.202.204
52.21.115.144
65.9.58.103
03aef28a1ff1337c859cab5bdf6f0557e940c6f7c82c8d00502bd46b2fde91fc
07ef661be38be006eb690a15613c557d418b8780900ff490545bb2b75d23fcd7
0a262007bf2063bb3edff585b582790d6c52a2872813e89cd4299b8423c247af
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
110208204c86d8f65bd5be507cc9abed5a65d499c4c9c9a1fffb53ef11046c1c
14f5db1f03b024cfbcc1c6e9eb0e5fa8fc658ca55bdde829bc1c14495b319cdb
19151ee5527abc4a3250857bd09c35b181c2edc42979771d29fee1eaf3b012bb
197c866fca7bc7ae09cfe133d73fee44018b3e6ba123efad800be1cef0c2e526
1985f2d29e27f6c8a54b740b8b384fab214215c090e16d6652295e4911db0fdd
199dd00b539a14db6dabe80e285db52e3dcaaf129ff7cc282f39eba7e5f777f4
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
24323a2bb3c6da5795183af10abe4738f2864183d6dc42af713aae3bc97c8433
27f3d8eee6bafcda0e234b9824cf18165118d846b59bc7390a83ce7c841ecd8c
2aeba6d48276f4c4d1b9f924f313c33842aed1fb015201a21e4d27f98d463117
2cd83d5a29914ad4797748d8e80fbc42c2131fbce9bbcdf2749a275fc7db875f
3aa49a969f76a3ee00b5f62de7cdd16ae54961ebc19a18e28f6a5c834ccf7b5d
3c7f1515ef582d8c9730e046767d496baa2b27a6408245fa517e715a9409b538
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
4373a7c880f00a8373da62d923fdb65d84317ae8755e8a66b48e098b29adf53f
46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251
4ae50e7e1ee7acdb1736efc4b6c497f90c1f4346957a605a71eaad9c41f14822
4b79016f8c4134f65a4664d94eddabce32c04ad5b49b0fb1c161e756076c881a
4f3ca38abc700f1d40a78c8f5625e9ffb376f73ceea49b0be4f09b58a331bb99
4f3d44464550faae5daa4a090d801ef80ffb455b2c82e9a41b2864b1b5edc7c2
4f92e39ce2fc824adc5bd2d7516a76dd3148e787273d54f07163394490a69364
501a69b7aef35f4e67d21f805d01be438bd664c056ba9983f95224181bbf25e0
5d9bc27ded0505ebc49055d28fc5c42e83c40ac1953725287ee2cfa8323fe4fc
60091e00b9f0c008542e8e37137e8715fdf75f9b9b6291e697c6e1a057484fd0
6262aff5f8247d62534a71c376656582b656f7561ccb44638ecb33be1a7632b4
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
692f6f364bbd9accd6866c67deb823580f463e1b7ea1fc81071abc2d5015ad26
6b6b4128d463875ca45df804c0c952487c94745bce3430cd0d05d92c588df58e
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
74f05793fca1bac5837ddc7e97c2493154e66aa1d93515458a61b2f271f5af5e
775f899c73c449a52853601201b194521a5851cd40a01b6f5ea162b90b22d91f
7976fe07c313417d11a0d2a8c6adc40090cf1e70f51c2aef5625fe9411074276
7fb131a692a953d5607dc88a166547b4102e83014086e989db8e57a71903a4ee
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86d1ce0b4aa3c1bb63c3c82710f999387b45a09732aefa91f410c503fd067335
886d60dd8f50634a407f7df224d23371945d12a89f7bd85b181711f6751dad25
8cb438bd4d1961f80ade4f1a295ca7de253630adcdd10473932908e638908c5e
8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d
92a55b1575d5572543d804cf2cdcd4f59b23d30f7543b65c1d9e2a1ce72cd4ac
9316527b46b0a79da0d9f3645bf09aa841adc9fbd1a97819b81e8609290e8173
93c032a2c28ceb070bdcbed147109c0136cbe323a1b951391074259bdb7a54ec
99400c60d24af70b28c9d71fa064601f9a83c521ff71763b8a3539cc9e8b174f
9a8d4f55a83aa4e1f884930f204914da68bd3f34cb4a66b8337b032f2ebabafc
9b3a1ca5b842a838490b420e8551c6e963ad583b28b4502204fa3c23989800ea
9e7e82e6951688006816988d2f7708e63dbe14d23b2b5dcba81e036ff229b134
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
a14b646dae4cb103a505b93b65be169b52a57ba39d191ee02357e473e80dca62
a54e7ed25533c1da7605ccccc232e036b1ba398ff110ed497bff803db3c49322
b77da047f8b3e770067992850b1c0b23b09ebe279ed9560d4582a96a60a55e36
b98ab5bb73706f94fc2256ea44dec015c8ba7ae790c735b39e1b51307c7b6656
bda277a4ba0af74a71829d0503828c4f976d0c56187bf9dfb4f7c017d99179d2
c04837b935b6d1fac0cbffc4a53bf19a6d89029742dbc4c8ad001c1078f5f957
c190efeaa9963a337c7927bd5fd6f35b706b5811c213531ef77a7d81badd563f
c2e606e1fc82ea3a554aad5d0520e25d2677b89a891dc5c49e7ace08fce92e25
c7161705c3ba9d4cfb3a067e16fd77f402b04fff3bb91cecdcc911cd4d7f1370
c92c6a06a05ebbc74655d4d596a2e169f97f1ad070ee073e4024106654441a7c
cc2d402072f792fd75a519a7994a0427991afa072302b404841e31861764d5a9
d16400e6b2166cf4a5b37b2216cde40c8637e6693cf623abbee9f8cd21a7dc33
d2437ddf45aa84303d14cc4569941c1ae58e8accca92216349c1332794015c6f
d7d00e88ba46fbfafd5c03c54553c1146fd850e7128fc85ae6d6e52b171837f4
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
dd8e9d8081f5cb325830c568e806f6d365c8bc5f0681a082cad9c2e371a4de9d
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
df9c5d1cbac3bf49d0a84988e62645b7eec7353e4843e1a4384f9bf4beddf4b2
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb
e09840622c40edd9be95ac745b1cc69498e2baed7d0dbb3f6b494a2ad59afc2c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6c882877a07628920766502cfd24ca9b217d89df7f742e0c3c971107ff07b50
ea8f6fb79fa2083c0b68b0a618446767c7bdf2d6aafc07d54a1c80e06a838c1c
ec7204b14a4c04d683b91fc4b1a6d855a09d43cb3a705e30a191048f4cd3e179
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fde702eb201b4b5a6f22b1c1b98434a4c513fabb5590c3f56bbde3fede32c99f
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869
ff8d50ef4f9407e026f4b1c12eaafa344900ec9df94f39df65a3cc1c968a4d57