link.newsletter.leadsgrp.com Open in urlscan Pro
52.72.189.101 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Submission: On July 30 via api (July 30th 2023, 10:18:38 am UTC) from BE — Scanned from DE

Summary HTTP 30 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 13 IPs in 2 countries across 9 domains to perform 30 HTTP transactions. The main IP is 52.72.189.101, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is link.newsletter.leadsgrp.com.

This is the only time link.newsletter.leadsgrp.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	52.72.189.101 52.72.189.101	14618 (AMAZON-AES) (AMAZON-AES)
1 6	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:780... 2a02:26f0:780::210:a40a	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:340... 2a02:26f0:3400:2a4::1931	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	52.222.236.34 52.222.236.34	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
2 3	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:828::200d	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f17... 2a03:2880:f177:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
2	104.244.42.8 104.244.42.8	13414 (TWITTER) (TWITTER)
30	13

3 52.72.189.101 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-72-189-101.compute-1.amazonaws.com

link.newsletter.leadsgrp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:831::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:780::210:a40a (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

platform.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3400:2a4::1931 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.pinterest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 52.222.236.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-34.fra56.r.cloudfront.net

cdnimgs.directiq.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::200e (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

developers.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f177:83:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.8 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	google.com 3 redirects apis.google.com — Cisco Umbrella Rank: 181 developers.google.com — Cisco Umbrella Rank: 11686 accounts.google.com — Cisco Umbrella Rank: 62	142 KB
6	twitter.com platform.twitter.com — Cisco Umbrella Rank: 1001 syndication.twitter.com — Cisco Umbrella Rank: 1206	149 KB
6	directiq.com cdnimgs.directiq.com	62 KB
3	leadsgrp.com link.newsletter.leadsgrp.com	34 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 108	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 170	89 KB
1	gstatic.com ssl.gstatic.com	6 KB
1	pinterest.com assets.pinterest.com — Cisco Umbrella Rank: 3731	1 KB
1	linkedin.com platform.linkedin.com — Cisco Umbrella Rank: 3079	160 KB
30	9

	Domain	Requested by
6	cdnimgs.directiq.com	link.newsletter.leadsgrp.com
6	apis.google.com	1 redirects link.newsletter.leadsgrp.com apis.google.com accounts.google.com
4	platform.twitter.com	link.newsletter.leadsgrp.com platform.twitter.com
3	developers.google.com	2 redirects apis.google.com
3	link.newsletter.leadsgrp.com	link.newsletter.leadsgrp.com
2	syndication.twitter.com	platform.twitter.com link.newsletter.leadsgrp.com
2	www.facebook.com	connect.facebook.net
2	accounts.google.com	apis.google.com link.newsletter.leadsgrp.com
2	connect.facebook.net	link.newsletter.leadsgrp.com connect.facebook.net
1	ssl.gstatic.com	accounts.google.com
1	assets.pinterest.com	link.newsletter.leadsgrp.com
1	platform.linkedin.com	link.newsletter.leadsgrp.com
30	12

This site contains links to these domains. Also see Links.

Domain
pinterest.com
www.elitearrowgo.com

Subject Issuer	Validity	Valid
*.apis.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.directiq.com Amazon RSA 2048 M02	`2023-02-28` - `2023-11-27`	9 months	crt.sh
*.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-06` - `2023-11-06`	a year	crt.sh
accounts.google.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-05-08` - `2023-08-06`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-10` - `2023-10-02`	3 months	crt.sh
syndication.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-02-05` - `2024-02-05`	a year	crt.sh

This page contains 6 frames:

Primary Page: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Frame ID: A826C48DA38711DFB165E3FC80B8967B
Requests: 20 HTTP requests in this frame

Frame: https://developers.google.com/?hl=de
Frame ID: E91B56EE80C20A03FD31EFEC7BB9C94C
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=http%3A%2F%2Flink.newsletter.leadsgrp.com
Frame ID: 2F522EC22CD82E76B3F1A7DA14198BA1
Requests: 2 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Flink.newsletter.leadsgrp.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.XCdl0Q1uUzA.O%2Fd%3D1%2Frs%3DAHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA%2Fm%3D__features__
Frame ID: 222E2D76307D9478DA6263472B71A1F0
Requests: 5 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.2b2d73daf636805223fb11d48f3e94f7.en.html
Frame ID: A5AC3C487373BD7D9F31B8153AFF589B
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?action=recommend&app_id=197498640292688&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3c8d7307efd488%26domain%3Dlink.newsletter.leadsgrp.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Flink.newsletter.leadsgrp.com%252Ff23a67e895fb57c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fclientlink.directiq.com%2FSOCIALFB2%2Fbc33b703-c152-404c-b016-7069231659fe&layout=button_count&locale=de_DE&sdk=joey&send=true&show_faces=false
Frame ID: 52626001B2B8C89E60BAB7051F2336D6
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

JG Wentworth › Over $20k in Credit Card Debt -- We Can Help JG Wentworth

Detected technologies

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

\.aspx?(?:$|\?)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Linkedin (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.linkedin\.com/in\.js

Twitter (Widgets) Expand

Overall confidence: 100%
Detected patterns

//platform\.twitter\.com/widgets\.js

Page Statistics

30
Requests

77 %
HTTPS

75 %
IPv6

9
Domains

12
Subdomains

13
IPs

2
Countries

644 kB
Transfer

1779 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://pinterest.com/pin/create/button/?url=https://clientlink.directiq.com/SOCIAL2/bc33b703-c152-404c-b016-7069231659fe&media=https://s3.amazonaws.com/TEMPLATETHUMBS/24016/336906-5f64fec0-300.png&description=Over%20$20k%20in%20Credit%20Card%20Debt%20--%20We%20Can%20Help

Search URL Search Domain Scan URL

URL: https://www.elitearrowgo.com/P1S2H6mQit2_LVh-m1f5J1zU5gBthse6Snz7L8tuTviblR-0O-1ehFFMBMFzT0CzaCLs7VnF-vVDunlWvqG5zQ~~/DQ1JGWentworth
Title: Cut Credit Card Debt Out of Your Life

Search URL Search Domain Scan URL

URL: https://www.elitearrowgo.com/rfR6Htk5ql4fYr4McuynnqSmfZJ8ozExs_DzyIXzmpjpwHBodsxNW4txR9H0Uzy4ZSlV2V_1iQ6wW7RJm4mcmw~~
Title: Unsubscribe

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

http://assets.pinterest.com/images/pidgets/pin_it_button.png HTTP 307
https://assets.pinterest.com/images/pidgets/pin_it_button.png

Request Chain 11

http://connect.facebook.net/de_DE/all.js HTTP 307
https://connect.facebook.net/de_DE/all.js

Request Chain 15

https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=http%3A%2F%2Flink.newsletter.leadsgrp.com&url=https%3A%2F%2Fclientlink.directiq.com%2FSOCIAL2%2Fbc33b703-c152-404c-b016-7069231659fe&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.XCdl0Q1uUzA.O%2Fd%3D1%2Frs%3DAHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA%2Fm%3D__features__ HTTP 301
http://developers.google.com/ HTTP 301
https://developers.google.com/ HTTP 302
https://developers.google.com/?hl=de

30 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request viewer3.aspx Show response
link.newsletter.leadsgrp.com/IO/ 31 KB
32 KB 322ms
181ms Document
text/html 52.72.189.101
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: HTTP/1.1
Server: 52.72.189.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-189-101.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 2515190a45ce0f8ef554cc5a11659c5537e4e496b3d45222bb24b61c8e3992a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private
Connection: keep-alive
Content-Length: 32162
Content-Type: text/html; charset=utf-8
Date: Sun, 30 Jul 2023 10:18:33 GMT
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET

GET
H/1.1 200
OK io-viewer.css
link.newsletter.leadsgrp.com/IO/css/ 851 B
1 KB 180ms
91ms Stylesheet
text/css 52.72.189.101
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://link.newsletter.leadsgrp.com/IO/css/io-viewer.css
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: HTTP/1.1
Server: 52.72.189.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-189-101.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1474b019aa5bcccf59bacb72d0bee5d7384e01a3a7f0d62b5b5773b68f0ee8d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Sun, 30 Jul 2023 10:18:33 GMT
Last-Modified: Sat, 01 Feb 2020 01:29:24 GMT
Server: Microsoft-IIS/10.0
ETag: "0b2499fd8d51:0"
X-Powered-By: ASP.NET
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 851

GET
H2 200 plusone.js Show response
apis.google.com/js/ 57 KB
22 KB 84ms
22ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e94ea0cfa8f1c2aec5dbfb767869f621a13fa48d4f821f27773fba589dcc41d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 30 Jul 2023 10:18:33 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22284
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "2be0365d9b585e97"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Jul 2023 10:18:33 GMT

GET
H/1.1 200
OK in.js Show response
platform.linkedin.com/ 510 KB
160 KB 53ms
8ms Script
text/javascript 2a02:26f0:780::210:a40a
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

http://platform.linkedin.com/in.js

Requested by

Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk

Protocol

HTTP/1.1

Server

2a02:26f0:780::210:a40a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Play /

Resource Hash

895f3740444229279a90a0cad4551410a2ea285de9654be552f579b5f5444098

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Sun, 30 Jul 2023 10:18:33 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-CDN-CLIENT-IP-VERSION: IPV6
X-CDN: AKAM
Connection: keep-alive
Content-Length: 163643
X-LI-UUID: AAYBsWe/JXx7967EiqRlfQ==
Server: Play
X-Li-Pop: prod-lva1-x
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
X-Li-Fabric: prod-lva1
Cache-Control: public, max-age=3600
X-LI-Proto: http/1.1
Expires: Sun, 30 Jul 2023 11:02:01 GMT

GET
H2

200

pin_it_button.png
assets.pinterest.com/images/pidgets/
Redirect Chain

http://assets.pinterest.com/images/pidgets/pin_it_button.png
https://assets.pinterest.com/images/pidgets/pin_it_button.png

909 B
1 KB

128ms
20ms

Image
image/png

2a02:26f0:3400:2a4::1931
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.pinterest.com/images/pidgets/pin_it_button.png
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: H2
Server: 2a02:26f0:3400:2a4::1931 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: f942d5999c18b372d0c74273c936fce1723b0761e67d56dfa80abac87eff864e

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

akamai-x-true-ttl: 86400
x-cdn: akamai
etag: "cf5ce2d2dcfa060f6032b0af60d45aa2"
vary: Accept-Encoding, Origin
access-control-max-age: 86400
content-type: image/png
access-control-allow-origin: *
access-control-allow-methods: GET
access-control-expose-headers: X-CDN
cache-control: max-age=76863
accept-ranges: bytes
alt-svc: h3=":443"; ma=600
content-length: 909

Redirect headers

Location: https://assets.pinterest.com/images/pidgets/pin_it_button.png
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H2 200 JGWentworth_2021-logo-6e5caa1a___.png
cdnimgs.directiq.com/212mediaak/ 6 KB
7 KB 54ms
9ms Image
image/png 52.222.236.34
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdnimgs.directiq.com/212mediaak/JGWentworth_2021-logo-6e5caa1a___.png
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-34.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5aed37e3c2b7ac9274e1cdc2d0b9021b414148eed5ddd6c040a0c9c72399e029

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 30 Jul 2023 01:21:25 GMT
via: 1.1 387adc951beb5181d840dfb5d1f09488.cloudfront.net (CloudFront)
last-modified: Wed, 07 Sep 2022 04:50:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 32229
etag: "0eb0cb38201ae07d99cdf461681a3d7b"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 6449
x-amz-cf-id: lfL-bgg2t-bR9PfSlxrP7sbjoU2KtiTW822hFt5FGQoeL1O0RetRnQ==

GET
H2 200 debtfree3-6e5caa1a___.png
cdnimgs.directiq.com/212mediaak/ 38 KB
38 KB 31ms
10ms Image
image/png 52.222.236.34
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdnimgs.directiq.com/212mediaak/debtfree3-6e5caa1a___.png
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-34.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fd15486979b6b148ab2e44e1eeb020dc3d5003df1bdcbaac7120dae11f7ac385

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 30 Jul 2023 04:25:35 GMT
via: 1.1 387adc951beb5181d840dfb5d1f09488.cloudfront.net (CloudFront)
last-modified: Wed, 07 Sep 2022 04:50:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 21179
etag: "a9f375a13fc3eeb726623d259c136695"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 38811
x-amz-cf-id: sO71hiGjD57Js-CnJQ1wShRYtX6U-M7J2PrTjISwbq_n1B8OmVKHQg==

GET
H2 200 freeestimate-6e5caa1a___.png
cdnimgs.directiq.com/212mediaak/ 2 KB
2 KB 30ms
9ms Image
image/png 52.222.236.34
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdnimgs.directiq.com/212mediaak/freeestimate-6e5caa1a___.png
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-34.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0ee9c8add8e821aac67a6c8f2b9d12d3050dc2eeb06413e92d7bf52733eeceda

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 30 Jul 2023 03:22:39 GMT
via: 1.1 387adc951beb5181d840dfb5d1f09488.cloudfront.net (CloudFront)
last-modified: Wed, 07 Sep 2022 04:50:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 24955
etag: "5e37846d30891235263e736e82d1889f"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 1733
x-amz-cf-id: vYiANTuZ1z-gJRSAN4uv9h9YK3ZXZUfsFTi9L1ziKurcC7Bj8Zkq-w==

GET
H2 200 fast-6e5caa1a___.png
cdnimgs.directiq.com/212mediaak/ 2 KB
3 KB 30ms
10ms Image
image/png 52.222.236.34
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdnimgs.directiq.com/212mediaak/fast-6e5caa1a___.png
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-34.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 854838cea2b799ae0d864e09a85623e8991538cc8c8f1e3be97ea0e441a6ab9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 30 Jul 2023 04:50:27 GMT
via: 1.1 387adc951beb5181d840dfb5d1f09488.cloudfront.net (CloudFront)
last-modified: Wed, 07 Sep 2022 04:50:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 19687
etag: "a72569306ee60d693abd28b7f393629c"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2269
x-amz-cf-id: EsLc6bU6kb_WHsuyoYLO5TGbfu6OrHBl5ErMgSlTXdKfWDqCt66pmQ==

GET
H2 200 casharrived-6e5caa1a___.png
cdnimgs.directiq.com/212mediaak/ 2 KB
3 KB 30ms
10ms Image
image/png 52.222.236.34
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdnimgs.directiq.com/212mediaak/casharrived-6e5caa1a___.png
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-34.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 054dfec4bbb9f35e747d16e005e70c697777a64583c83f3d1a54b9b22f9bf909

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Sat, 29 Jul 2023 23:37:06 GMT
via: 1.1 387adc951beb5181d840dfb5d1f09488.cloudfront.net (CloudFront)
last-modified: Wed, 07 Sep 2022 04:50:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 38488
etag: "5b771d3a525f90c42373328b700b66a0"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2446
x-amz-cf-id: 0tTKgIpaPjZboapTugw29TEzZe2JJKLE_HLajgGkeK-SYFXkLSOhbA==

GET
H2 200 trustpilot-excellent-6e5caa1a___.png
cdnimgs.directiq.com/212mediaak/ 9 KB
10 KB 30ms
9ms Image
image/png 52.222.236.34
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdnimgs.directiq.com/212mediaak/trustpilot-excellent-6e5caa1a___.png
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-34.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08983a39be7fc0746b30abaaff8beb61c66cb7af0e70cde5dff5d08b250ec0bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-amz-version-id: null
date: Sat, 29 Jul 2023 19:21:51 GMT
via: 1.1 387adc951beb5181d840dfb5d1f09488.cloudfront.net (CloudFront)
last-modified: Wed, 07 Sep 2022 04:50:40 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P4
age: 53803
etag: "dd3df06c30d5d55c11c3101863fca84b"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 9564
x-amz-cf-id: ww3coVYjtHsPpW5UpScrbUKJRrxWGayjO3gw3409_58pnzNoup2Efg==

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.XCdl0Q1uUzA.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA/ 157 KB
55 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.XCdl0Q1uUzA.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

018a72e5bf9df35d4e28088acbeaa16274f4c45318ffd6e00c370dc30a493941

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 08:09:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 94137
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55616
x-xss-protection: 0
last-modified: Tue, 04 Jul 2023 15:24:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 28 Jul 2024 08:09:36 GMT

GET
H2

200

all.js Show response
connect.facebook.net/de_DE/
Redirect Chain

http://connect.facebook.net/de_DE/all.js
https://connect.facebook.net/de_DE/all.js

3 KB
2 KB

33ms
8ms

Script
application/x-javascript

2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/de_DE/all.js

Requested by

Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk

Protocol

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ccf5eef4054ea28aac7a0dd7a3905dd324f127df36075867e6bcb128cf3c29ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 30 Jul 2023 10:18:33 GMT
content-md5: R9XMKKdXkKrQM/IpwiWrVA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1684
x-fb-debug: BJUuY2dgAGPZp2yaQbU5W83N/Vu8JGHq0p4GEukmjxcgITrqQMUm3JEzYTKQC1WlahZcD1anPSSSQuZtNNy4gw==
x-fb-content-md5: 57dd57cfd8db7df47ce36ea7bfd2c69d
cross-origin-opener-policy: same-origin-allow-popups
etag: "b804a3fa0ea7b390bfd99f80d97fda2c"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
expires: Sun, 30 Jul 2023 10:19:12 GMT

Redirect headers

Location: https://connect.facebook.net/de_DE/all.js#xfbml=1&appId=197498640292688
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 91 KB
28 KB 28ms
14ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: http://platform.twitter.com/widgets.js
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk
Protocol: HTTP/1.1
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BB0) /
Resource Hash: 392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Sun, 30 Jul 2023 10:18:33 GMT
Content-Encoding: gzip
Age: 751
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 27630
Last-Modified: Tue, 24 Jan 2023 21:41:51 GMT
Server: ECS (amb/6BB0)
Etag: "9e99725b7a4cd730a934afba2a438bb5+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=1800

GET
H/1.1 200
OK viewer-band-bg.png
link.newsletter.leadsgrp.com/IO/img/ 1 KB
1 KB 93ms
91ms Image
image/png 52.72.189.101
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://link.newsletter.leadsgrp.com/IO/img/viewer-band-bg.png
Requested by: Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/css/io-viewer.css
Protocol: HTTP/1.1
Server: 52.72.189.101 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-72-189-101.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 9114afb896563696fdb57ef685154469ad41fe40c5312b26095a6f6e3b566d48

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/IO/css/io-viewer.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Sun, 30 Jul 2023 10:18:33 GMT
Last-Modified: Sat, 01 Feb 2020 01:29:24 GMT
Server: Microsoft-IIS/10.0
ETag: "0b2499fd8d51:0"
X-Powered-By: ASP.NET
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1129

GET
H2 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.XCdl0Q1uUzA.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA/ 98 KB
34 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.XCdl0Q1uUzA.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA/cb=gapi.loaded_1?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

edfeb329a15573460818274cb90be26efa07766742e0df57c90a171c34a6c6db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 08:47:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 91892
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34465
x-xss-protection: 0
last-modified: Tue, 04 Jul 2023 15:24:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 28 Jul 2024 08:47:01 GMT

GET
H2

200

/
developers.google.com/ Frame E91B
Redirect Chain

https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&size=medium&origin=http%3A%2F%2Flink.newsletter.leadsgrp.com&url=https%3A%2F%2Fclientlink.directiq.com%2FSOCIAL2%2Fbc33b703-c152-404c-b016...
http://developers.google.com/
https://developers.google.com/
https://developers.google.com/?hl=de

0
0

878ms
877ms

Document
text/html

2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://developers.google.com/?hl=de

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'self'; object-src 'none'; script-src 'strict-dynamic' 'unsafe-inline' https: http: 'nonce-JXoYWbLfhU6lKbTHnBZ8A6PBa+GGb2' 'unsafe-eval'; report-uri https://csp.withgoogle.com/csp/devsite/v2
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://link.newsletter.leadsgrp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 27407
content-security-policy: base-uri 'self'; object-src 'none'; script-src 'strict-dynamic' 'unsafe-inline' https: http: 'nonce-JXoYWbLfhU6lKbTHnBZ8A6PBa+GGb2' 'unsafe-eval'; report-uri https://csp.withgoogle.com/csp/devsite/v2
content-type: text/html; charset=utf-8
date: Sun, 30 Jul 2023 10:18:34 GMT
expires: 0
last-modified: Tue, 25 Jul 2023 17:29:42 GMT
pragma: no-cache
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: Cookie Accept-Encoding
x-cloud-trace-context: 571c7cad64e9ed236ea07e226e0dec13
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 163
content-security-policy: base-uri 'self'; object-src 'none'; script-src 'strict-dynamic' 'unsafe-inline' https: http: 'nonce-E10mnFHf6/pk81ABJ7Assz1euqDl+3' 'unsafe-eval'; report-uri https://csp.withgoogle.com/csp/devsite/v2
content-type: text/html; charset=utf-8
date: Sun, 30 Jul 2023 10:18:33 GMT
expires: 0
location: /?hl=de
pragma: no-cache
server: Google Frontend
strict-transport-security: max-age=63072000; includeSubdomains; preload
vary: Cookie Accept-Encoding
x-cloud-trace-context: acdd93ed63d7bf535964bbb95a41b1f6
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H/1.1 200
OK widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html Show response
platform.twitter.com/widgets/ Frame 2F52 320 KB
104 KB 63ms
15ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=http%3A%2F%2Flink.newsletter.leadsgrp.com
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B7C) /
Resource Hash: 4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf

Request headers

Referer: http://link.newsletter.leadsgrp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 146829
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 105435
Content-Type: text/html; charset=utf-8
Date: Sun, 30 Jul 2023 10:18:33 GMT
Etag: "95e1b50b0c179aefb47b5b211bb347b5+gzip"
Last-Modified: Tue, 24 Jan 2023 21:41:13 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (amb/6B7C)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H2 200 postmessageRelay Show response
accounts.google.com/o/oauth2/ Frame 222E 566 B
809 B 71ms
29ms Document
text/html 2a00:1450:4001:828::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Flink.newsletter.leadsgrp.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.XCdl0Q1uUzA.O%2Fd%3D1%2Frs%3DAHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.XCdl0Q1uUzA.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA/cb=gapi.loaded_1?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7ab4de19143fd486598fba0e8209589122f27c38a115b00ea7105cedb6f313c6

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /o/cspreport script-src 'report-sample' 'nonce-gYlEW1TNvqUBtIqxw7Cu8A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://link.newsletter.leadsgrp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /o/cspreport script-src 'report-sample' 'nonce-gYlEW1TNvqUBtIqxw7Cu8A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-type: text/html; charset=utf-8
date: Sun, 30 Jul 2023 10:18:33 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 all.js Show response
connect.facebook.net/de_DE/ 309 KB
87 KB 20ms
10ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/de_DE/all.js?hash=ae390a7ee4f6195a3e53eab53bb498a6

Requested by

Host: connect.facebook.net
URL: http://connect.facebook.net/de_DE/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f6da94f65c7394206c963ceb7e07e717b5280363398088928fc0d5d7eaf4f5d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: http://link.newsletter.leadsgrp.com/
Origin: http://link.newsletter.leadsgrp.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 30 Jul 2023 10:18:33 GMT
content-md5: m3JmPGlMTJwhiIjuBcN3ww==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 88668
x-fb-debug: AFX56P1lilXtr2YD/k/uQcZd0tfIsRzzLBvUQa/xLWvpeB3wv/8uqLeyyL4+g8wlINnLEtH57+TKW2Cz2zE9AA==
x-fb-content-md5: c662e6e12a9d5966bdcc77f92c0e4dc6
cross-origin-opener-policy: same-origin-allow-popups
etag: "686104c5307aace2123a7270fc1123d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin: *
priority: u=3,i
expires: Mon, 29 Jul 2024 09:17:09 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 64ms
38ms Fetch
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=197498640292688&input_token&origin=1&redirect_uri=http%3A%2F%2Flink.newsletter.leadsgrp.com%2FIO%2Fviewer3.aspx%3Fsid%3D00ab0c02rottra2mxmirppk&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/de_DE/all.js?hash=ae390a7ee4f6195a3e53eab53bb498a6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Sun, 30 Jul 2023 10:18:33 GMT
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
pragma: no-cache
x-fb-debug: 9FjtRUZEfQLwYOh47I97Ac98GRz+1p9BX2Du+Yz7V8gpRVV61itDJd3+1+cxmjnnW8r+L7VNgO3LwUkjDq6vpg==
fb-s: unknown
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: http://link.newsletter.leadsgrp.com
origin-agent-cluster: ?0
access-control-expose-headers: fb-s
fb-error-description: "This endpoint may only be called from an HTTPS Origin."
access-control-allow-credentials: true
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(self), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 204 cspreport
accounts.google.com/o/ Frame 222E 0
250 B 27ms
26ms Other
text/html 2a00:1450:4001:828::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/cspreport

Requested by

Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /o/cspreport, script-src 'report-sample' 'nonce-PFcQl4B1kd8Wf9alqYSJNw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Flink.newsletter.leadsgrp.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.XCdl0Q1uUzA.O%2Fd%3D1%2Frs%3DAHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA%2Fm%3D__features__
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Sun, 30 Jul 2023 10:18:33 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /o/cspreport, script-src 'report-sample' 'nonce-PFcQl4B1kd8Wf9alqYSJNw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 3698212825-postmessagerelay.js Show response
ssl.gstatic.com/accounts/o/ Frame 222E 12 KB
6 KB 84ms
25ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/3698212825-postmessagerelay.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=http%3A%2F%2Flink.newsletter.leadsgrp.com&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.XCdl0Q1uUzA.O%2Fd%3D1%2Frs%3DAHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA%2Fm%3D__features__

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37acf5f6aa181790c9f46f7a25b5c89ecc46c35603b9b62c3086228faf72b26d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 05:40:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103111
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5184
x-xss-protection: 0
last-modified: Thu, 27 Jul 2023 16:14:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="federated-signon-mpm-access"
vary: Accept-Encoding
report-to: {"group":"federated-signon-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/federated-signon-mpm-access"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 28 Jul 2024 05:40:02 GMT

GET
H3 200 rpc:shindig_random.js Show response
apis.google.com/js/ Frame 222E 18 KB
7 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/rpc:shindig_random.js?onload=init

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bf3d504fcfb31533bc66d365a6174095cb3d47779273d8e46cf6318350fe2f2

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 30 Jul 2023 10:18:33 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7121
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "0ceea68d957ab262"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Jul 2023 10:18:33 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 2F52 869 B
658 B 173ms
129ms Fetch
application/json 104.244.42.8
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=32039c772bd0e7868cd50f1e8b54f6883951055b

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.2b2d73daf636805223fb11d48f3e94f7.html?origin=http%3A%2F%2Flink.newsletter.leadsgrp.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-response-time: 115
date: Sun, 30 Jul 2023 10:18:33 GMT
content-encoding: gzip
strict-transport-security: max-age=631138519
last-modified: Sun, 30 Jul 2023 10:18:33 GMT
server: tsa_o
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
x-transaction-id: 9df3360fde05408e
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
perf: 7626143928
x-connection-hash: 0681d3d0d99efb55942736ca50e6827c1b7061b11751feb7e9f51dd5c4047fc2
content-length: 337

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.XCdl0Q1uUzA.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA/ Frame 222E 63 KB
22 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.XCdl0Q1uUzA.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-NsQQIx4v-fzv0ma0HnLgz-16yvA/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/rpc:shindig_random.js?onload=init

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7ea0ca08dbb47fdc3290b1f5c8fb5ae7dc21801e579fbc05d1d2ddf44434d7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

date: Sat, 29 Jul 2023 11:50:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80869
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22897
x-xss-protection: 0
last-modified: Tue, 04 Jul 2023 15:24:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 28 Jul 2024 11:50:44 GMT

GET
H/1.1 200
OK button.e7f9415a2e000feaab02c86dd5802747.js Show response
platform.twitter.com/js/ 8 KB
3 KB 14ms
14ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.e7f9415a2e000feaab02c86dd5802747.js
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BC3) /
Resource Hash: ef116c4b154888a36784c143110b264cfe6528a4061c5dcc14e6431ecfbcac56

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Date: Sun, 30 Jul 2023 10:18:33 GMT
Content-Encoding: gzip
Age: 154130
x-amz-server-side-encryption: AES256
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Content-Length: 2618
Last-Modified: Tue, 24 Jan 2023 21:41:06 GMT
Server: ECS (amb/6BC3)
Etag: "506673dbdb9085e7201e137e893cc152+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-tw-cdn: VZ
Cache-Control: public, max-age=315360000

GET
H/1.1 200
OK tweet_button.2b2d73daf636805223fb11d48f3e94f7.en.html Show response
platform.twitter.com/widgets/ Frame A5AC 37 KB
14 KB 15ms
15ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/tweet_button.2b2d73daf636805223fb11d48f3e94f7.en.html
Requested by: Host: platform.twitter.com
URL: http://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BC3) /
Resource Hash: a7fd41fd349db8949a256323b8d9af1f86fe14bbd84214553ca70cb488a95e7b

Request headers

Referer: http://link.newsletter.leadsgrp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 154127
Cache-Control: public, max-age=315360000
Content-Encoding: gzip
Content-Length: 13592
Content-Type: text/html; charset=utf-8
Date: Sun, 30 Jul 2023 10:18:33 GMT
Etag: "28919252629e2fa1d4ed52f48cb66ac0+gzip"
Last-Modified: Tue, 24 Jan 2023 21:41:10 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (amb/6BC3)
Server-Timing: x-cache;desc= HIT,x-tw-cdn;desc=VZ
Vary: Accept-Encoding
X-Cache: HIT
x-amz-server-side-encryption: AES256
x-tw-cdn: VZ

GET
H2 200 embeds
syndication.twitter.com/i/jot/ 43 B
103 B 117ms
117ms Image
image/gif 104.244.42.8
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot/embeds?l=%7B%22widget_origin%22%3A%22http%3A%2F%2Flink.newsletter.leadsgrp.com%2FIO%2Fviewer3.aspx%3Fsid%3D00ab0c02rottra2mxmirppk%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22m%3Anocount%3A%22%2C%22context%22%3A%22rufous-eol%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1690712313885%2C%22dnt%22%3Afalse%2C%22client_version%22%3A%22aaf4084522e3a%3A1674595607486%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22share%22%2C%22action%22%3A%22impression%22%7D%7D&session_id=32039c772bd0e7868cd50f1e8b54f6883951055b

Requested by

Host: link.newsletter.leadsgrp.com
URL: http://link.newsletter.leadsgrp.com/IO/viewer3.aspx?sid=00ab0c02rottra2mxmirppk

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.8 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://link.newsletter.leadsgrp.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

x-response-time: 103
date: Sun, 30 Jul 2023 10:18:33 GMT
strict-transport-security: max-age=631138519
last-modified: Sun, 30 Jul 2023 10:18:33 GMT
server: tsa_o
vary: Origin
content-type: image/gif
x-transaction-id: 71ae5fae9f1cb830
cache-control: must-revalidate, max-age=600
perf: 7626143928
x-connection-hash: 0681d3d0d99efb55942736ca50e6827c1b7061b11751feb7e9f51dd5c4047fc2
content-length: 43

GET
DATA 200
OK truncated
/ Frame A5AC 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame 5262 0
1 KB 36ms
36ms Document
text/html 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?action=recommend&app_id=197498640292688&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3c8d7307efd488%26domain%3Dlink.newsletter.leadsgrp.com%26is_canvas%3Dfalse%26origin%3Dhttp%253A%252F%252Flink.newsletter.leadsgrp.com%252Ff23a67e895fb57c%26relation%3Dparent.parent&container_width=0&href=https%3A%2F%2Fclientlink.directiq.com%2FSOCIALFB2%2Fbc33b703-c152-404c-b016-7069231659fe&layout=button_count&locale=de_DE&sdk=joey&send=true&show_faces=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/de_DE/all.js?hash=ae390a7ee4f6195a3e53eab53bb498a6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://link.newsletter.leadsgrp.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html;charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 30 Jul 2023 10:18:34 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
x-content-type-options: nosniff
x-fb-debug: mCzcDft7UHQAKtljH/mJnYguX57TEBbw8KiF/s7SvYKy3QCCKPJaroWiWGoaAs9P5R8JHJvrx1C+/4zCpmvkuQ==
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			link.newsletter.leadsgrp.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: 1nhfbmbvhblk0olezxdu5ipm

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: This document requires 'TrustedScript' assignment.
other	error	URL: chrome-error://chromewebdata/ Message: Refused to display 'https://developers.google.com/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accounts.google.com
apis.google.com
assets.pinterest.com
cdnimgs.directiq.com
connect.facebook.net
developers.google.com
link.newsletter.leadsgrp.com
platform.linkedin.com
platform.twitter.com
ssl.gstatic.com
syndication.twitter.com
www.facebook.com
104.244.42.8
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:828::200d
2a00:1450:4001:830::200e
2a00:1450:4001:831::2003
2a00:1450:4001:831::200e
2a02:26f0:3400:2a4::1931
2a02:26f0:780::210:a40a
2a03:2880:f084:d:face:b00c:0:3
2a03:2880:f177:83:face:b00c:0:25de
52.222.236.34
52.72.189.101
018a72e5bf9df35d4e28088acbeaa16274f4c45318ffd6e00c370dc30a493941
054dfec4bbb9f35e747d16e005e70c697777a64583c83f3d1a54b9b22f9bf909
08983a39be7fc0746b30abaaff8beb61c66cb7af0e70cde5dff5d08b250ec0bc
0bf3d504fcfb31533bc66d365a6174095cb3d47779273d8e46cf6318350fe2f2
0ee9c8add8e821aac67a6c8f2b9d12d3050dc2eeb06413e92d7bf52733eeceda
1474b019aa5bcccf59bacb72d0bee5d7384e01a3a7f0d62b5b5773b68f0ee8d3
2515190a45ce0f8ef554cc5a11659c5537e4e496b3d45222bb24b61c8e3992a4
302da628a6afc3e93f1b86bf7c65e4d6536d8283d78266964822a76d1c645aa4
37acf5f6aa181790c9f46f7a25b5c89ecc46c35603b9b62c3086228faf72b26d
392c9fa9cd1273a2a89d1a83a69cd1f63f21d1d55e7be21e1d8f51f25145668b
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf
4e94ea0cfa8f1c2aec5dbfb767869f621a13fa48d4f821f27773fba589dcc41d
5aed37e3c2b7ac9274e1cdc2d0b9021b414148eed5ddd6c040a0c9c72399e029
7ab4de19143fd486598fba0e8209589122f27c38a115b00ea7105cedb6f313c6
854838cea2b799ae0d864e09a85623e8991538cc8c8f1e3be97ea0e441a6ab9c
895f3740444229279a90a0cad4551410a2ea285de9654be552f579b5f5444098
9114afb896563696fdb57ef685154469ad41fe40c5312b26095a6f6e3b566d48
a7fd41fd349db8949a256323b8d9af1f86fe14bbd84214553ca70cb488a95e7b
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
ccf5eef4054ea28aac7a0dd7a3905dd324f127df36075867e6bcb128cf3c29ac
d7ea0ca08dbb47fdc3290b1f5c8fb5ae7dc21801e579fbc05d1d2ddf44434d7d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edfeb329a15573460818274cb90be26efa07766742e0df57c90a171c34a6c6db
ef116c4b154888a36784c143110b264cfe6528a4061c5dcc14e6431ecfbcac56
f6da94f65c7394206c963ceb7e07e717b5280363398088928fc0d5d7eaf4f5d7
f942d5999c18b372d0c74273c936fce1723b0761e67d56dfa80abac87eff864e
fd15486979b6b148ab2e44e1eeb020dc3d5003df1bdcbaac7120dae11f7ac385

link.newsletter.leadsgrp.com Open in urlscan Pro 52.72.189.101 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

30 Requests

77 %HTTPS

75 %IPv6

9 Domains

12 Subdomains

13 IPs

2 Countries

644 kBTransfer

1779 kBSize

1 Cookies

3 Outgoing links

Redirected requests

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

link.newsletter.leadsgrp.com Open in urlscan Pro
52.72.189.101 Public Scan

Screenshot
Live screenshot

Full Image

30
Requests

77 %
HTTPS

75 %
IPv6

9
Domains

12
Subdomains

13
IPs

2
Countries

644 kB
Transfer

1779 kB
Size

1
Cookies

30 HTTP transactions
1 data transactions