urlscan.io logo urlscan.io
SecurityTrails logo

irsfreshstart.org Open in urlscan Pro
141.193.213.10  Public Scan

Go To Rescan Add Verdict Report
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Submission: On November 21 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 16 IPs in 3 countries across 14 domains to perform 49 HTTP transactions. The main IP is 141.193.213.10, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is irsfreshstart.org.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on September 22nd 2023. Valid for: a year.
This is the only time irsfreshstart.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
16 141.193.213.10 209242 (CLOUDFLAR...)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
3 2a05:d018:56f... 16509 (AMAZON-02)
1 2600:9000:206... 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 5 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 3.225.185.199 14618 (AMAZON-AES)
1 2600:9000:223... 16509 (AMAZON-02)
2 2a03:2880:f08... 32934 (FACEBOOK)
7 2001:4860:480... 15169 (GOOGLE)
1 2a03:2880:f17... 32934 (FACEBOOK)
1 2620:1ec:46::45 8075 (MICROSOFT...)
2 143.204.98.44 16509 (AMAZON-02)
1 2 68.219.88.97 8075 (MICROSOFT...)
49 16
16    141.193.213.10 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
irsfreshstart.org
1    2a02:26f0:480:f::213:7ec6 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
use.typekit.net
3    2a05:d018:56f:b800:f42c:e894:1fb0:3740 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
obseu.bzcclandlord.com
1    2600:9000:206f:4000:15:a0d3:77c0:93a1 (United States)

ASN16509 (AMAZON-02, US)
www.clickcease.com
2    2a00:1450:4001:80e::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
2    2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
5    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
c.bing.com
1    2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    3.225.185.199 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-185-199.compute-1.amazonaws.com
api.trustedform.com
1    2600:9000:223d:8a00:1c:7f1a:6680:93a1 (United States)

ASN16509 (AMAZON-02, US)
cdn.trustedform.com
2    2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
connect.facebook.net
7    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
1    2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2620:1ec:46::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.clarity.ms
2    143.204.98.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-44.fra50.r.cloudfront.net
solutions.invocacdn.com
2    68.219.88.97 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.clarity.ms
Apex Domain
Subdomains		 Transfer
16 irsfreshstart.org
irsfreshstart.org
26 KB
9 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27
region1.google-analytics.com — Cisco Umbrella Rank: 2462
22 KB
5 bing.com
bat.bing.com — Cisco Umbrella Rank: 366
c.bing.com — Cisco Umbrella Rank: 236
16 KB
3 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 827
c.clarity.ms — Cisco Umbrella Rank: 1405
2 KB
3 bzcclandlord.com
obseu.bzcclandlord.com — Cisco Umbrella Rank: 120605
38 KB
2 invocacdn.com
solutions.invocacdn.com — Cisco Umbrella Rank: 6513
42 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 174
91 KB
2 trustedform.com
api.trustedform.com — Cisco Umbrella Rank: 25271
cdn.trustedform.com — Cisco Umbrella Rank: 28978
4 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 35
184 KB
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 110
185 B
1 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 33
571 B
1 clickcease.com
www.clickcease.com — Cisco Umbrella Rank: 11310
43 KB
1 typekit.net
use.typekit.net — Cisco Umbrella Rank: 506
1 KB
0 invoca.net Failed
pnapi.invoca.net Failed
49 14
Domain Requested by
16 irsfreshstart.org irsfreshstart.org
7 region1.google-analytics.com www.googletagmanager.com
4 bat.bing.com www.googletagmanager.com
bat.bing.com
irsfreshstart.org
3 obseu.bzcclandlord.com irsfreshstart.org
obseu.bzcclandlord.com
2 c.clarity.ms 1 redirects
2 solutions.invocacdn.com irsfreshstart.org
solutions.invocacdn.com
2 connect.facebook.net irsfreshstart.org
connect.facebook.net
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 www.googletagmanager.com irsfreshstart.org
www.googletagmanager.com
1 c.bing.com 1 redirects
1 www.clarity.ms bat.bing.com
1 www.facebook.com irsfreshstart.org
1 cdn.trustedform.com irsfreshstart.org
1 api.trustedform.com 1 redirects
1 googleads.g.doubleclick.net www.googletagmanager.com
1 www.clickcease.com irsfreshstart.org
1 use.typekit.net irsfreshstart.org
0 pnapi.invoca.net Failed solutions.invocacdn.com
49 18

This site contains no links.

Subject Issuer Validity Valid
irsfreshstart.org
Cloudflare Inc ECC CA-3		 2023-09-22 -
2024-09-21		 a year crt.sh
use.typekit.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-21 -
2024-10-21		 a year crt.sh
*.bzcclandlord.com
ZeroSSL ECC Domain Secure Site CA		 2023-11-07 -
2024-02-05		 3 months crt.sh
clickcease.com
Amazon RSA 2048 M02		 2022-10-27 -
2023-11-25		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 01		 2023-10-24 -
2024-04-21		 6 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-10-23 -
2024-01-15		 3 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2023-08-30 -
2023-11-28		 3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1		 2023-08-29 -
2024-08-29		 a year crt.sh
invocacdn.com
Amazon RSA 2048 M02		 2023-09-24 -
2024-10-21		 a year crt.sh

This page contains 1 frames:

Frame: https://irsfreshstart.org/thank-you-1/?outcome=success&clickcease=block
Frame ID: 599C397F855768D1A4626E8C73CF9457
Requests: 49 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Page Statistics

49
Requests

88 %
HTTPS

75 %
IPv6

14
Domains

18
Subdomains

16
IPs

3
Countries

468 kB
Transfer

1469 kB
Size

24
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21
  • https://api.trustedform.com/trustedform.js?provide_referrer=false&field=xxTrustedFormCertUrl&l=17005785012090.20056835547681962 HTTP 301
  • https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&l=17005785012090.20056835547681962
Request Chain 44
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=CCD61D6F15AF4B5FA0E73836A05DC41E&RedC=c.clarity.ms&MXFR=01B115F97EBA6C7832C206297ABA620F HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=CCD61D6F15AF4B5FA0E73836A05DC41E&MUID=1D87994EE81E612B1A248A9EE9CC6055

49 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
irsfreshstart.org/thank-you-1/ 		24 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
330af621c43b64a90da3bcbf1ffbdfd2bdae8becd5e8a0585ea67d95e1240fc0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=600, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8299c569fa5530c4-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 21 Nov 2023 14:55:01 GMT
link
<https://irsfreshstart.org/wp-json/>; rel="https://api.w.org/" <https://irsfreshstart.org/wp-json/wp/v2/pages/489>; rel="alternate"; type="application/json" <https://irsfreshstart.org/?p=489>; rel=shortlink
server
cloudflare
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache
MISS
x-cache-group
normal
x-cacheable
SHORT
x-powered-by
WP Engine
cookieAccess.min.js
irsfreshstart.org/wp-content/themes/IFS/assets/js/ 		550 B
419 B 		Script
General
Check archive.org
Download Go to
Full URL
https://irsfreshstart.org/wp-content/themes/IFS/assets/js/cookieAccess.min.js
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a5415b9f8b41969cb75676e0ead407fc311249273f89d396f660333c4faf9aa5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 07 Sep 2023 15:16:23 GMT
server
cloudflare
age
3847
etag
W/"64f9e947-226"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56fa9aa30c4-FRA
alt-svc
h3=":443"; ma=86400
sjz7aoe.css
use.typekit.net/ 		8 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.typekit.net/sjz7aoe.css?ver=1
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
84ff1d86d234e297b080d37adc1056cdd8d9a0990b0dcf98960df39eb366458d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

Referer
https://irsfreshstart.org/
Origin
https://irsfreshstart.org
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
date
Tue, 21 Nov 2023 14:55:01 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
1074
71c9ecc2a4c84ce749859e9306919707.js
obseu.bzcclandlord.com/i/ 		100 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://obseu.bzcclandlord.com/i/71c9ecc2a4c84ce749859e9306919707.js
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a05:d018:56f:b800:f42c:e894:1fb0:3740 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
0d882d47e8abafdaa4c120e04db3a8f7b19ae91967d25c828f1bb21f41c78e2f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type
text/javascript; charset=utf-8
date
Tue, 21 Nov 2023 14:55:01 GMT
cache-control
max-age=43200
content-encoding
gzip
etag
"18eb3-Zzt18Ye3DHjts52DqlEubkEE7ww"
content-length
37304
expires
Wed, 22 Nov 2023 02:55:01 GMT
stat.js
www.clickcease.com/monitor/ 		142 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clickcease.com/monitor/stat.js
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:4000:15:a0d3:77c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
889794fd02992011c4b843a05190531656d4c6148e6d4375be6bab3432b580d0
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://clickcease.com https://*.clickcease.com; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
Cf02rYNryv9UIBzoGOQeQJTZ2QU2vf2Y
content-encoding
gzip
via
1.1 58c21e16c9e093deb494fbb4de260efa.cloudfront.net (CloudFront)
date
Tue, 21 Nov 2023 14:55:00 GMT
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self' https://clickcease.com https://*.clickcease.com; upgrade-insecure-requests;
x-amz-cf-pop
FRA56-C1
age
11
x-amz-server-side-encryption
AES256
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 12 Sep 2023 09:05:15 GMT
server
AmazonS3
etag
W/"e112b8bf96f23bc2970347a3c98e37fc"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
microphone 'none'; camera 'none';
x-amz-cf-id
LTrfl0f8HXfkOeEoBbaqtSRTwL8ckRgcWkWweXOV82O6NXiR3ltpww==
global-b.min.css
irsfreshstart.org/wp-content/themes/IFS/assets/css/ 		35 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://irsfreshstart.org/wp-content/themes/IFS/assets/css/global-b.min.css?ver=13
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6e7ebc7c4aeb37b5c218ab6c3610be5f5b1780fc955b13f0249ecc35c2e7549

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 10 Oct 2023 16:02:12 GMT
server
cloudflare
age
3847
etag
W/"65257584-8a78"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56f99a830c4-FRA
alt-svc
h3=":443"; ma=86400
front-end.js
irsfreshstart.org/wp-content/plugins/clickcease-click-fraud-protection/includes/assets/js/ 		2 KB
953 B 		Script
General
Check archive.org
Download Go to
Full URL
https://irsfreshstart.org/wp-content/plugins/clickcease-click-fraud-protection/includes/assets/js/front-end.js?ver=1.0
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e2f8548007f7aaa9cb8fafb7c1e2a9cec5dc429fd7a4c92d66402aadda700a9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 21 Nov 2023 13:10:31 GMT
server
cloudflare
age
3847
etag
W/"655cac47-9ae"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56fa9ad30c4-FRA
alt-svc
h3=":443"; ma=86400
envelope-open-red.svg
irsfreshstart.org/wp-content/uploads/2023/08/ 		1 KB
730 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://irsfreshstart.org/wp-content/uploads/2023/08/envelope-open-red.svg
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
98d91918017fa4245876e7869a2c224c064460f81c29e6cc5c4045f25f9e3685

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 09 Aug 2023 15:45:34 GMT
server
cloudflare
etag
W/"64d3b49e-4be"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56fca46bb3d-FRA
alt-svc
h3=":443"; ma=86400
headphones-mic-red.svg
irsfreshstart.org/wp-content/uploads/2021/02/ 		1009 B
763 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://irsfreshstart.org/wp-content/uploads/2021/02/headphones-mic-red.svg
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8333bdf68e2b6ae5b641a9eaa01ae0c29c92b5b4707691e196b5c95ff006d71a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 15 Aug 2022 13:32:06 GMT
server
cloudflare
etag
W/"62fa4ad6-3f1"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56fca4ebb3d-FRA
alt-svc
h3=":443"; ma=86400
form-checkmark-red.svg
irsfreshstart.org/wp-content/uploads/2023/08/ 		768 B
626 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://irsfreshstart.org/wp-content/uploads/2023/08/form-checkmark-red.svg
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6aa827a066e425152874c0830a601b478857e276d66085393038d818e00740cb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 09 Aug 2023 15:45:34 GMT
server
cloudflare
etag
W/"64d3b49e-300"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56fca50bb3d-FRA
alt-svc
h3=":443"; ma=86400
process.min.css
irsfreshstart.org/wp-content/themes/IFS/template-parts/blocks/css/ 		3 KB
751 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://irsfreshstart.org/wp-content/themes/IFS/template-parts/blocks/css/process.min.css?ver=6.4.1
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
891702d58f361236b2c02c1b20d61fce53b1a580943542c5e3dbfe1980150f81

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 11 Oct 2023 17:37:59 GMT
server
cloudflare
etag
W/"6526dd77-b96"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56fa9b030c4-FRA
alt-svc
h3=":443"; ma=86400
global.min.js
irsfreshstart.org/wp-content/themes/IFS/assets/js/ 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://irsfreshstart.org/wp-content/themes/IFS/assets/js/global.min.js?ver=15
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f796a4e99a9a921a3f021b20e5221a9d0cf0e5af5da91f1f4a8fe2ac183422b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Tue, 03 Oct 2023 13:02:30 GMT
server
cloudflare
age
3846
etag
W/"651c10e6-2afc"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56fa9b330c4-FRA
alt-svc
h3=":443"; ma=86400
gtm.js
www.googletagmanager.com/ 		262 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NR58N28
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
028fd486b23216a6ba8063892ebc84f8621c75c5f3e88eac1703ae74d244117e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
93561
x-xss-protection
0
last-modified
Tue, 21 Nov 2023 12:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 21 Nov 2023 14:55:01 GMT
steps-block-gray.svg
irsfreshstart.org/wp-content/uploads/2023/08/ 		713 B
648 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://irsfreshstart.org/wp-content/uploads/2023/08/steps-block-gray.svg
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5eccfe0d16ada5f79c41d282ded38ac2810c282358078c39cc6eaa6eb6687be1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 09 Aug 2023 15:45:34 GMT
server
cloudflare
etag
W/"64d3b49e-2c9"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56fea65bb3d-FRA
alt-svc
h3=":443"; ma=86400
steps-block.svg
irsfreshstart.org/wp-content/uploads/2021/02/ 		741 B
655 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://irsfreshstart.org/wp-content/uploads/2021/02/steps-block.svg
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c42508c8ef28c3e242d3a9dad65b348d9417c14252ea34b44c5932d57108bc7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Mon, 15 Aug 2022 13:32:11 GMT
server
cloudflare
etag
W/"62fa4adb-2e5"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56fea66bb3d-FRA
alt-svc
h3=":443"; ma=86400
irs-fresh-start-horizontal-2colors-web.svg
irsfreshstart.org/wp-content/uploads/2023/07/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://irsfreshstart.org/wp-content/uploads/2023/07/irs-fresh-start-horizontal-2colors-web.svg
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6cb7d82e3246ec364e787757bedb25e9001ab8cc6a1dcbb671a480837c9c0a40

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 09 Aug 2023 15:45:34 GMT
server
cloudflare
age
3845
etag
W/"64d3b49e-1284"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56ffa77bb3d-FRA
alt-svc
h3=":443"; ma=86400
phone-icon.svg
irsfreshstart.org/wp-content/uploads/2021/02/ 		776 B
755 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://irsfreshstart.org/wp-content/uploads/2021/02/phone-icon.svg
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
39f3150d3f0e4e61467e4e5f69a66f9f475ca887e326d719ae386093fe7fe2c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Aug 2022 13:32:10 GMT
server
cloudflare
age
3845
etag
W/"62fa4ada-308"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56ffa7abb3d-FRA
alt-svc
h3=":443"; ma=86400
irs-fresh-start-footer.svg
irsfreshstart.org/wp-content/uploads/2021/03/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://irsfreshstart.org/wp-content/uploads/2021/03/irs-fresh-start-footer.svg
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
057851f67d2bfc349564c5b26853eced2bfffd54e0feb7e0938e6a26fe6fe4b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Mon, 15 Aug 2022 13:33:07 GMT
server
cloudflare
age
3844
etag
W/"62fa4b13-120c"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
8299c56ffa7bbb3d-FRA
alt-svc
h3=":443"; ma=86400
js
www.googletagmanager.com/gtag/ 		278 KB
92 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-6FENPCF6Z2&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NR58N28
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
03814d897519169605126a08ee572e152e72dee27754b169c0dad3ae53d4185a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
94320
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Tue, 21 Nov 2023 14:55:01 GMT
analytics.js
www.google-analytics.com/ 		52 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NR58N28
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 21 Nov 2023 13:49:38 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
3923
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Tue, 21 Nov 2023 15:49:38 GMT
bat.js
bat.bing.com/ 		45 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NR58N28
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 21 Nov 2023 14:55:01 GMT
last-modified
Fri, 10 Nov 2023 20:09:55 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: C96BFA71C82149AA93224618C06CA048 Ref B: FRAEDGE1320 Ref C: 2023-11-21T14:55:01Z
etag
"80abcdf1114da1:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
13175
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/449000076/ 		43 B
571 B 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/449000076/?random=1700578501204&cv=11&fst=1700578501204&bg=ffffff&guid=ON&async=1&gtm=45He3b81v837849253&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&hn=www.googleadservices.com&frm=0&tiba=Thank%20You%20-%20IRS%20Fresh%20Start&rdp=1&auid=1464747674.1700578501&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NR58N28
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bootstrap.js
cdn.trustedform.com/
Redirect Chain
  • https://api.trustedform.com/trustedform.js?provide_referrer=false&field=xxTrustedFormCertUrl&l=17005785012090.20056835547681962
  • https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&l=17005785012090.20056835547681962
8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.trustedform.com/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&l=17005785012090.20056835547681962
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Server
2600:9000:223d:8a00:1c:7f1a:6680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
35cbf6a6e5e7ff72ebb142669e1727de048df4fc13fc9fb5d9bd2d8334de7a71

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date
Tue, 21 Nov 2023 14:55:02 GMT
x-amz-version-id
D_l7Wi1wOYgTC52uzRMI5HnwJykAKtLr
content-encoding
gzip
last-modified
Wed, 08 Nov 2023 19:52:40 GMT
server
AmazonS3
via
1.1 eaedf92fd05c53aa96f20b6322b473e6.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P3
etag
W/"e11406d1e7ba652ddbe0623e1207c210"
vary
Accept-Encoding
x-cache
Miss from cloudfront
content-type
application/javascript
x-amz-cf-id
_HZIPme6355LsB37sILwytopMTUQAoCf6rlrrmNJY5-GRlhVz-TR2w==

Redirect headers

location
https://cdn.trustedform.com:443/bootstrap.js?provide_referrer=false&field=xxTrustedFormCertUrl&l=17005785012090.20056835547681962
date
Tue, 21 Nov 2023 14:55:01 GMT
server
awselb/2.0
content-length
134
content-type
text/html
fbevents.js
connect.facebook.net/en_US/ 		202 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 21 Nov 2023 14:55:01 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
54273
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
v4aYNioqiJleYSEbHEsgTah+VzyBNo+Q02xeDQnUSup4AM1ZobKC1BdThlg7ikRBhoB+SbkI808xTEsCHk/JNA==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
www.google-analytics.com/j/ 		3 B
209 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=230407270&t=pageview&_s=1&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&ul=en-us&de=UTF-8&dt=Thank%20You%20-%20IRS%20Fresh%20Start&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=849189433&gjid=142627951&cid=435981570.1700578501&tid=UA-187141017-1&_gid=661488612.1700578501&_r=1&_slc=1&gtm=45He3b81n81NR58N28v837849253&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=86489150
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://irsfreshstart.org/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://irsfreshstart.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/ 		0
255 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-6FENPCF6Z2&gtm=45je3b81v888613286z8837849253&_p=1700578501086&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=435981570.1700578501&ul=en-us&_eu=Ag&_geo=1&_rdi=1&_s=1&sid=1700578501&sct=1&seg=0&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&dt=Thank%20You%20-%20IRS%20Fresh%20Start&en=page_view&_fv=1&_ss=1&tfd=1356
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6FENPCF6Z2&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://irsfreshstart.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-6FENPCF6Z2&gtm=45je3b81v888613286&_p=1700578501086&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=435981570.1700578501&ul=en-us&_eu=AAg&_geo=1&_rdi=1&_s=2&sid=1700578501&sct=1&seg=0&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&dt=Thank%20You%20-%20IRS%20Fresh%20Start&en=form_submission&_c=1&_et=3&tfd=1361
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6FENPCF6Z2&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://irsfreshstart.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-6FENPCF6Z2&gtm=45je3b81v888613286&_p=1700578501086&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=435981570.1700578501&ul=en-us&_eu=AAg&_geo=1&_rdi=1&_s=3&sid=1700578501&sct=1&seg=0&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&dt=Thank%20You%20-%20IRS%20Fresh%20Start&en=form_submission&_c=1&_et=1&tfd=1366
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6FENPCF6Z2&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://irsfreshstart.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/ 		0
45 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-6FENPCF6Z2&gtm=45je3b81v888613286&_p=1700578501086&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=435981570.1700578501&ul=en-us&_eu=AkA&_geo=1&_rdi=1&_s=4&sid=1700578501&sct=1&seg=0&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&dt=Thank%20You%20-%20IRS%20Fresh%20Start&en=scroll&epn.percent_scrolled=90&_et=10&tfd=1383
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6FENPCF6Z2&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://irsfreshstart.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-6FENPCF6Z2&gtm=45je3b81v888613286&_p=1700578501086&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=435981570.1700578501&ul=en-us&_eu=AAg&_geo=1&_rdi=1&_s=5&sid=1700578501&sct=1&seg=0&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&dt=Thank%20You%20-%20IRS%20Fresh%20Start&en=form_submission&_c=1&epn.percent_scrolled=90&_et=1&tfd=1383
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6FENPCF6Z2&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://irsfreshstart.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
1258587048181779
connect.facebook.net/signals/config/ 		139 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1258587048181779?v=2.9.138&r=stable&domain=irsfreshstart.org
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
525db5b8f264bbcab367ab4eb35c89bea0dabfb1cba3878d3678eac665747678
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Tue, 21 Nov 2023 14:55:01 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
reporting-endpoints
pragma
public
x-fb-debug
ZEGel/1SnJ4w7g5p2XB379pMvkvMONGIfAcCDLL/8sf4IAbrgzKoz9etTQhNzFEDaTmqAJKlX73rtyNyhwK4OA==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin
*
expires
Sat, 01 Jan 2000 00:00:00 GMT
ct
obseu.bzcclandlord.com/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://obseu.bzcclandlord.com/ct?id=37091&url=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&sf=0&tpi=&ch=&uvid=&tsf=0&tsfmi=&tsfu=&cb=1700578501440&hl=2&op=0&ag=4157294124&rand=035127702269181192019566972077210386173126502098688919729022140180191160615018086971&fs=1600x1200&fst=1600x1200&np=win32&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDEzMTVdLFszNywiWzMzMTYyMjQwNDksZnVuY3Rpb24obmV3VmFsdWUpIHtcbiAgICAgICAgICAgICAgYWRkQ29udGVudFdpbmRvd1Byb3h5KHRoaXMpXG4gICAgICAgICAgICAgIC8vIFJlc2V0IHByb3BlcnR5LCB0aGUgaG9vayBpcyBvbmx5IG5lZWRlZCBvbmNlXG4gICAgICAgICAgICAgIE9iamVjdC5kZWZpbmVQcm9wZXJ0eShpZnJhbWUsICdzcmNkb2MnLCB7XG4gICAgICAgICAgICAgICAgY29uZmlndXJhYmxlOiBmYWxzZSxcbiAgICAgICAgICAgICAgICB3cml0YWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgdmFsdWU6IF9zcmNkb2NcbiAgICAgICAgICAgICAgfSlcbiAgICAgICAgICAgICAgX2lmcmFtZS5zcmNkb2MgPSBuZXdWYWx1ZVxuICAgICAgICAgICAgfV0iXSxbImNiIiwiMCwwLDAsMCwwLDAsMCwwLDAsMiwwLDEsMCw2LDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMiwyLDAsMCwwLDEsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwzLDAiXSxbLTEsIi0iXSxbLTIsIi0iXSxbLTMsIltcImludGVybmFsLXBkZi12aWV3ZXJcIixcIm1oamZibWRnY2ZqYmJwYWVvam9mb2hvZWZnaWVoamFpXCIsXCJpbnRlcm5hbC1uYWNsLXBsdWdpblwiXSJdLFstNCwiLSJdLFstNSwiLSJdLFstNiwiLSJdLFstNywiLSJdLFstOCwiLSJdLFstOSwiKyJdLFstMTAsIi0iXSxbLTExLCJ7XCJ0XCI6XCJcIixcIm1cIjpbXCJkZXNjcmlwdGlvblwiLFwib2c6dGl0bGVcIixcIm9nOmRlc2NyaXB0aW9uXCJdfSJdLFstMTIsIm51bGwiXSxbLTEzLCItIl0sWy0xNCwiLSJdLFstMTUsIi0iXSxbLTE2LCIwIl0sWy0xNywiNCJdLFstMTgsIlswLDAsMCwxXSJdLFstMTksIlswLDAsMCwwLDAsMCwxLDI0LDI0LFwiLVwiLDE2MDAsMTIwMCwxNjAwLDEyMDAsMTYwMCwxMjAwLDE2MDAsMTIwMCwwLDAsMCwwLFwiLVwiLFwiLVwiLDE2MDAsMTIwMF0iXSxbLTIwLCI0MzU5ODE1NzAuMTcwMDU3ODUwMSJdLFstMjEsIi0iXSxbLTIyLCJbXCJuXCIsXCJuXCJdIl0sWy0yMywiKyJdLFstMjQsIltdIl0sWy0yNSwiLSJdLFstMjYsIntcInRqaHNcIjoxMTkwMDAwMCxcInVqaHNcIjoxMDAwMDAwMCxcImpoc2xcIjozNzYwMDAwMDAwfSJdLFstMjcsIlswLDEwLDAsXCI0Z1wiLG51bGxdIl0sWy0yOCwiZW4tVVMsZW4iXSxbLTI5LCItIl0sWy0zMCwiW1widlwiLDBdIl0sWy0zMSwiZmFsc2UiXSxbLTMyLCItIl0sWy0zMywiLSJdLFstMzQsIi0iXSxbLTM1LCJbMTcwMDU3ODUwMTQyOSwtMV0iXSxbLTM2LCJbXCI0LzNcIixcIjQvM1wiXSJdLFstMzcsIi0xNDQtNjYtMTgwLSJdLFstMzgsImwsLTEsLTEsMCwwLDEzNSwwLDAsMjQsODk0LC0xLDAsMTEzMS45LDExMzEuOSwxNDMyLDE0MzMiXSxbLTM5LCJbXCIyMDAzMDEwN1wiLDQsXCJHZWNrb1wiLFwiTmV0c2NhcGVcIixcIk1vemlsbGFcIixudWxsLG51bGwsdHJ1ZSw4LGZhbHNlLG51bGwsMyxmYWxzZSx0cnVlLG51bGwsMCx0cnVlLHRydWVdIl0sWy00MCwiMzMiXSxbLTQxLCItIl0sWy00MiwiMTcyNDI5NzY1MyJdLFstNDMsIjAwMDAwMDAxMDEwMDAwMDEwMDExMTAxMTAwMTAxMTAxMDAwMDAxIl0sWy00NCwiMCwwLDAsNSJdLFstNDUsIi0iXSxbLTQ2LCIwIl0sWy00NywiLSJdLFstNDgsIjAsMCJdLFstNDksIi0iXSxbLTUwLCItIl0sWy01MSwiLSJdLFstNTIsIi0iXSxbLTUzLCIxMDAiXSxbLTU0LCJ7XCJoXCI6W1wiXzNcIixcIjMyOTk5MTM2OVwiXSxcImRcIjpbXSxcImJcIjpbXSxcInNcIjoxfSJdLFstNTUsIjEiXSxbLTU2LCJsYW5kc2NhcGUtcHJpbWFyeSJdLFstNTcsIldFMFpWMXhPY1ZoWFhWVmNTeGNGV2xaVVNVeE5YRjBIR1dKWVNobFlTVWxWUUdRWkVWeFBXRlVaV0UwWkJWaFhWbGRBVkZaTVNnY1pFUU1PQXdnTUNRNElBUkFWR1FWWVYxWlhRRlJXVEVvSEF3Z0JBd29KRUJWWVRSbDRTMHRZUUJkY1hCa1JVVTFOU1VvREZoWldXMHBjVEJkYlExcGFWVmhYWFZWV1MxMFhXbFpVRmxBV0RnaGFBRnhhV2d0WURWb0JEVnBjRGcwQUFRd0FYQUFLQ1E4QUNBQU9DUTRYVTBvRENBTVBEd2dQQ1JBVldFMFpUUmRjUVVsV1MwMUtHUkZSVFUxSlNnTVdGbFpiU2x4TUYxdERXbHBWV0ZkZFZWWkxYUmRhVmxRV1VCWU9DRm9BWEZwYUMxZ05XZ0VOV2x3T0RRQUJEQUJjQUFvSkR3QUlBQT09Il0sWy01OCwiLSJdLFstNTksImRlZmF1bHQiXSxbLTYwLCItIl0sWy02MSwie1wid2dzbFwiOlwiMDtcIixcInBjZlwiOlwiYmdyYTh1bm9ybVwifSJdLFstNjIsIjgwIl0sWy02MywiMCJdLFstNjQsIlswLFwiXCIsW11dIl0sWy02NSwiLSJdLFstNjYsImdlb2xvY2F0aW9uLHN0b3JhZ2VhY2Nlc3MsZ2FtZXBhZCxjaGVjdCxtaWRpLGRpc3BsYXljYXB0dXJlLHVzYixsb2NhbGZvbnRzLHBpY3R1cmVpbnBpY3R1cmUscHVibGlja2V5Y3JlZGVudGlhbHNnZXQsb3RwY3JlZGVudGlhbHMsY2h1YWZvcm1mYWN0b3IsZW5jcnlwdGVkbWVkaWEsY2hzYXZlZGF0YSxjaHVhZnVsbHZlcnNpb25saXN0LGNodWF3b3c2NCxjaGRvd25saW5rLGNocHJlZmVyc2NvbG9yc2NoZW1lLHN5bmN4aHIsY2h1YW1vZGVsLGNocHJlZmVyc3JlZHVjZWR0cmFuc3BhcmVuY3ksc2VyaWFsLGNhbWVyYSxjaHByZWZlcnNyZWR1Y2VkbW90aW9uLHByaXZhdGVzdGF0ZXRva2VuaXNzdWFuY2UsaWRlbnRpdHljcmVkZW50aWFsc2dldCxjaHVhZnVsbHZlcnNpb24sZnVsbHNjcmVlbixjaGRwcix1bmxvYWQsa2V5Ym9hcmRtYXAsY2h1YXBsYXRmb3JtLGd5cm9zY29wZSxjaHVhbW9iaWxlLHdpbmRvd21hbmFnZW1lbnQsY2h1YSxtYWduZXRvbWV0ZXIsYWNjZWxlcm9tZXRlcixwcml2YXRlc3RhdGV0b2tlbnJlZGVtcHRpb24sY2h1YWFyY2gseHJzcGF0aWFsdHJhY2tpbmcsaWRsZWRldGVjdGlvbixjaHVhcGxhdGZvcm12ZXJzaW9uLGNod2lkdGgsY2xpcGJvYXJkcmVhZCxjaHZpZXdwb3J0d2lkdGgscGF5bWVudCxjaHZpZXdwb3J0aGVpZ2h0LGNocnR0LGF1dG9wbGF5LGNyb3Nzb3JpZ2luaXNvbGF0ZWQsaGlkLGNodWFiaXRuZXNzLHNjcmVlbndha2Vsb2NrLGNsaXBib2FyZHdyaXRlLGNoZGV2aWNlbWVtb3J5LG1pY3JvcGhvbmUiXSxbLTY3LCItIl0sWyJkZGIiLCIwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwxLDAsMSwxLDEsMCwwLDAsMCwxLDMsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMSwwLDEsMCwwLDAsMCwwLDAsMCwwIl0sWyJibmNoIiwzNV0sWyJhYm5jaCIsMzZdXQ%3D%3D&dep=0&pre=0&sdd=%7B%7D&cri=AOmpsLwsbL&pto=1443&ver=57&gac=435981570.1700578501&mei=&ap=&fe=1&duid=1.1700578501.3VqfOZptoQpcqUpL&suid=1.1700578501.T1QEdSCxHbhljbiu&tuid=1.1700578501.oq6l47FdSpONDP2L&fbc=-&gtm=W10%3D&it=26%2C1057%2C300&fbcl=-&gacl=&gacsd=-&rtic=lRSAE%2F9ZfMHk4DPa68OKVJ1iSG0%3DLDXsVYzpXmC%2FeX1g90%2FAco2TMT5fPaf8y0HcEvgnXcfJA%2FWIVkjFXjQlCaLFnYSrIDziJ%2FHr1w8WcCcb5EUig04XIQLSPPa5q165PcrZ24oXNhTNhGMn%2BcOuIk05F3GWJRc%3D&bgc=-&spa=1&urid=0&ab=
Requested by
Host: obseu.bzcclandlord.com
URL: https://obseu.bzcclandlord.com/i/71c9ecc2a4c84ce749859e9306919707.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a05:d018:56f:b800:f42c:e894:1fb0:3740 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
ae7b079f256a2f6d6382309cbf7cbb02ebc119cdcaab892c4fcd7ad82cb3499d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type
text/javascript
pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
cache-control
no-cache, no-store, must-revalidate
content-encoding
gzip
content-length
1265
expires
Fri, 01 Jan 1990 00:00:00 GMT
259001831.js
bat.bing.com/p/action/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/259001831.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
0b1ec6ff5019b807e78eb419b28bf477ccd1c91be8c4725aadfcfdd66d2a4f9e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
date
Tue, 21 Nov 2023 14:55:01 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: DCFCF0E2A5DD405F9D6C3A1B55A81698 Ref B: FRAEDGE1320 Ref C: 2023-11-21T14:55:01Z
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
cache-control
private,max-age=60
/
www.facebook.com/tr/ 		0
185 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1258587048181779&ev=PageView&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&rl=&if=false&ts=1700578501518&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4126&fbp=fb.1.1700578501516.623867747&cs_est=true&ler=empty&it=1700578501397&coo=false&rqm=GET
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 21 Nov 2023 14:55:01 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
admin-ajax.php
irsfreshstart.org/wp-admin/ 		47 B
389 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://irsfreshstart.org/wp-admin/admin-ajax.php
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/wp-content/plugins/clickcease-click-fraud-protection/includes/assets/js/front-end.js?ver=1.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Tue, 21 Nov 2023 14:55:01 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-powered-by
WP Engine
alt-svc
h3=":443"; ma=86400
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://irsfreshstart.org
cache-control
no-cache, must-revalidate, max-age=0
access-control-allow-credentials
true
x-robots-tag
noindex
cf-ray
8299c5728d6bbb3d-FRA
expires
Wed, 11 Jan 1984 05:00:00 GMT
tc_imp.gif
obseu.bzcclandlord.com/tracker/ 		43 B
79 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://obseu.bzcclandlord.com/tracker/tc_imp.gif?e=37dfbd8ee84e00126aeec232e2428a9c9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5d168d642617071a10acf9f29f674082d28e02256c49f8707652836dd734c7043256219453545c66570a97ba6a4677be26bb25cb43e2913bf05365ac5c7e721bda53ee46f49486df3dbb2907fe7ccaa85c3fd80e6041201293d1006cfd60b3f493a0180dec1edae97dfa2bc8169b1adc597cff3200e714561c4b92177af998ffe4198b6dec06c213f85e162ae7d133722b325f817c99ec59b058609fc6e359143e3dd385293e88864c06513c157a77bb9e70392652b48d1c2ad7f4ec3ee3b8192d4079b4a7a49d8677a0dbde5eee489d5d3772aeb9cce4b46d8fd9e16c893008c3e5db6e4d57e56b7dfc914730bfdeaf268d53ac14b0831dc44ace997a973d669e9824d06290dabca79df3f1477fe425b3baf82b4d26f9913f82be50eb0102419457459a8993d9c5ec8221c23bc69da59e34e36c7e79927228989dde552ac7a720e65cea845b977aa07a1d5a43cd37b81ccd87e03fbe80789f4fa9cfccdc649f54482da50f450830097f87f42392629482c724e5c636b3d03bd9c2b1a833cfa0e05b616e98ee4e0483f7491442f5e6a26cb62886f802bea677e52de468ca0dc61ec5f62edb0870b5ddce3f6a61247a7e195605aee28965da03b2424e5d28ffb44fda9f1009feb9cda6ae3a909eb8a5d3a6eb881f5d36e95a94aa4b2cdf516f70de635d7070eb72af7618deeadd7e8c61d13996a824cea40e9b7d1322230b600e9fc7edc7217d559b045893d3dda7adc9550582adbb7d94d36e7ad8d2123c75e490d95621b43b985e9f1ae33b870fdac813f8bd2eff9a88d2984f7ef2e13b63807eba90b1ab169f6d280b0494684052adbe5e8fec17cd8586c954cd848f2f133647be38ab68b647e6c430c2204933433a2f29e80bda896607b13dc4f2fc328d9d4e8c2226a6177f259ae9d4595dba63e99c539f5e651240ae3a3283a8d768ce50369f8512bfbbdc9ef516b92e1d5a47aa2b7f00c5d51e40a878a2a7953f85c1ed105c7ba26a250f0cca1751f8c6af1e4d94650787f4c73eb7a0dacd2530a622f9473c44c6254e63c792401899dce2caf0e642a56bda31867485d65d9a8fad7c6eb0d852c89ca2a090a694df3e418fef3947db62c318975ffdf66bf58ddfdf2ff7da89e4e91938c7b0f4f442dd46d7114520006294d5656ac077b31eacca44f1487bb934009922b9d82e28e6323d&cri=AOmpsLwsbL&ts=88&cb=1700578501528
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a05:d018:56f:b800:f42c:e894:1fb0:3740 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires
Fri, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
43
content-type
image/gif
0
bat.bing.com/action/ 		0
284 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=259001831&tm=gtm002&Ver=2&mid=6e5aa9b9-ecef-4057-b9b0-627f642a6761&sid=f2793d20887d11ee80fc41ef6458567e&vid=f2797170887d11ee8f25c122340467b0&vids=1&msclkid=N&gtm_tag_source=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Thank%20You%20-%20IRS%20Fresh%20Start&p=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&r=&lt=1525&evt=pageLoad&sv=1&rn=742993
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 21 Nov 2023 14:55:01 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 4623530F72D54FF593D19D6A2427695E Ref B: FRAEDGE1320 Ref C: 2023-11-21T14:55:01Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
259001831
www.clarity.ms/tag/uet/ 		841 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/uet/259001831?insights=1
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/259001831.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires
-1
date
Tue, 21 Nov 2023 14:55:02 GMT
x-azure-ref
20231121T145501Z-dwbbz411f15ah9wwvmm4nm851c0000000gbg000000004gn3
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
841
request-context
appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0
invoca-latest.min.js
solutions.invocacdn.com/js/ 		125 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://solutions.invocacdn.com/js/invoca-latest.min.js
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-44.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6759a429a6cb3b659f255988622200afb4ceeb78f0e6e0eee44de205d550182d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
ft0EgrjFyRMxkyc1.Woa7qyFKXOvrjrJ
content-encoding
gzip
via
1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
date
Tue, 21 Nov 2023 14:22:59 GMT
x-amz-cf-pop
FRA50-C1
age
1922
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Tue, 15 Aug 2023 15:52:18 GMT
server
AmazonS3
etag
W/"1cd78f5c872f2966dcc15b34d64f2b51"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
cache-control
max-age=3600
x-amz-cf-id
q7Y0XDRmBHruhc_zifUQuq9ML3ZY8FcRtko0y3ez9ZtqzCh93t6Pcw==
collect
region1.google-analytics.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-6FENPCF6Z2&gtm=45je3b81v888613286z8837849253&_p=1700578501086&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=435981570.1700578501&ul=en-us&_eu=Ag&_geo=1&_rdi=1&_s=6&sid=1700578501&sct=1&seg=0&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&dt=Thank%20You%20-%20IRS%20Fresh%20Start&en=g4_form_fill&_et=165&tfd=1568
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6FENPCF6Z2&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://irsfreshstart.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/ 		0
54 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-6FENPCF6Z2&gtm=45je3b81v888613286&_p=1700578501086&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=435981570.1700578501&ul=en-us&_eu=AAg&_geo=1&_rdi=1&_s=7&sid=1700578501&sct=1&seg=0&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&dt=Thank%20You%20-%20IRS%20Fresh%20Start&en=form_submission&_c=1&_et=4&tfd=1568
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-6FENPCF6Z2&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://irsfreshstart.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
0
bat.bing.com/action/ 		0
119 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=259001831&tm=gtm002&Ver=2&mid=6e5aa9b9-ecef-4057-b9b0-627f642a6761&sid=f2793d20887d11ee80fc41ef6458567e&vid=f2797170887d11ee8f25c122340467b0&vids=0&msclkid=N&gc=USD&gtm_tag_source=ga4&tpp=1&ea=g4_form_fill&en=Y&p=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F&sw=1600&sh=1200&sc=24&evt=custom&rn=156153
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 21 Nov 2023 14:55:01 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 5F7066E836684C418262B9B200F082A3 Ref B: FRAEDGE1320 Ref C: 2023-11-21T14:55:01Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
97ecf958-276a-451b-8c08-57936eaad66c
https://irsfreshstart.org/ 		529 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://irsfreshstart.org/97ecf958-276a-451b-8c08-57936eaad66c
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/thank-you-1/?outcome=success
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b81b1818b1e8764100e82c29b40a4ed69eaee14eb1ad85850dc11eadfd530b99

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Length
529
Content-Type
tag-live.js
solutions.invocacdn.com/js/networks/1822/1297351863/ 		11 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://solutions.invocacdn.com/js/networks/1822/1297351863/tag-live.js
Requested by
Host: solutions.invocacdn.com
URL: https://solutions.invocacdn.com/js/invoca-latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-44.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id
3YCkRPzSeWS2trDJ8qPxBT2P_Em1CRyC
content-encoding
br
via
1.1 5f6905ea282e042ad3334bfed8a840ce.cloudfront.net (CloudFront)
date
Tue, 21 Nov 2023 14:55:02 GMT
last-modified
Thu, 10 Aug 2023 17:18:34 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
x-amz-server-side-encryption
AES256
etag
W/"9221337bf38b74cc56eb1b1633ed9a3f"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/javascript
cache-control
max-age=300
x-amz-replication-status
COMPLETED
x-amz-cf-id
wgkHyhzVBYRKhgvr7JXlWjDv5V4w6v1McQN_yV5WTLs1NW-bZnPugA==
/
irsfreshstart.org/thank-you-1/ 		0
650 B 		Document
General
Check archive.org
Download Go to
Full URL
https://irsfreshstart.org/thank-you-1/?outcome=success&clickcease=block
Requested by
Host: irsfreshstart.org
URL: https://irsfreshstart.org/wp-content/plugins/clickcease-click-fraud-protection/includes/assets/js/front-end.js?ver=1.0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.10 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://irsfreshstart.org/thank-you-1/?outcome=success
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
max-age=0, must-revalidate, private
cf-cache-status
DYNAMIC
cf-ray
8299c57588c5bb3d-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 21 Nov 2023 14:55:03 GMT
server
cloudflare
vary
Accept-Encoding Accept-Encoding Accept-Encoding
x-cache
MISS
x-cache-group
normal
x-cacheable
NO:403
x-powered-by
WP Engine
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=CCD61D6F15AF4B5FA0E73836A05DC41E&RedC=c.clarity.ms&MXFR=01B115F97EBA6C7832C206297ABA620F
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=CCD61D6F15AF4B5FA0E73836A05DC41E&MUID=1D87994EE81E612B1A248A9EE9CC6055
42 B
444 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=CCD61D6F15AF4B5FA0E73836A05DC41E&MUID=1D87994EE81E612B1A248A9EE9CC6055
Protocol
H2
Server
68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://irsfreshstart.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:01 GMT
last-modified
Wed, 30 Aug 2023 19:01:41 GMT
server
Microsoft-IIS/10.0
etag
"8d59566974dbd91:0"
x-powered-by
ASP.NET
content-type
image/gif
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 21 Nov 2023 14:55:02 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: EBEECDFC77444F71ACB3DE8AAA443AE1 Ref B: FRAEDGE1320 Ref C: 2023-11-21T14:55:02Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=CCD61D6F15AF4B5FA0E73836A05DC41E&MUID=1D87994EE81E612B1A248A9EE9CC6055
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
collect
region1.google-analytics.com/g/ 		0
0
0
bat.bing.com/actionp/ 		0
0
na.jsonp
pnapi.invoca.net/1822/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
region1.google-analytics.com
URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-6FENPCF6Z2&gtm=45je3b81v888613286&_p=1700578501086&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=435981570.1700578501&ul=en-us&_eu=Ag&_geo=1&_rdi=1&_s=8&sid=1700578501&sct=1&seg=0&dl=https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess&dt=&en=user_engagement&_et=1605&tfd=3180
Domain
bat.bing.com
URL
https://bat.bing.com/actionp/0?ti=259001831&tm=gtm002&Ver=2&mid=6e5aa9b9-ecef-4057-b9b0-627f642a6761&sid=f2793d20887d11ee80fc41ef6458567e&vid=f2797170887d11ee8f25c122340467b0&vids=0&msclkid=N&evt=pageHide
Domain
pnapi.invoca.net
URL
https://pnapi.invoca.net/1822/na.jsonp?network_id=1822&js_version=4.30.3&tag_id=1822%2F1297351863&request_data_shared_params=%7B%22outcome%22%3A%22success%22%2C%22calling_page%22%3A%22https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess%22%2C%22campaigncode%22%3A%22TDN-02317-N4K1M4%22%2C%22domain%22%3A%22irsfreshstart.org%22%2C%22google_analytics_property_id%22%3A%22UA-187141017-1%22%2C%22landing_page%22%3A%22https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess%22%2C%22optional_parameters%22%3A%22%3Foutcome%3Dsuccess%22%2C%22subsource%22%3A%22IRSFreshStart_Voice%22%2C%22vendor%22%3A%22Two%20Rivers%20Capital%22%2C%22_fbp%22%3A%22fb.1.1700578501516.623867747%22%2C%22g_cid%22%3A%22435981570.1700578501%22%2C%22utm_medium%22%3A%22direct%22%2C%22utm_source%22%3A%22direct%22%2C%22invoca_id%22%3A%22i-a972857a-e623-4772-d053-2429427442ad%22%7D&client_messages=%7B%7D&client_info=%7B%22url%22%3A%22https%3A%2F%2Firsfreshstart.org%2Fthank-you-1%2F%3Foutcome%3Dsuccess%22%2C%22referrer%22%3A%22%22%2C%22cores%22%3A4%2C%22platform%22%3A%22Win32%22%2C%22screenWidth%22%3A1600%2C%22screenHeight%22%3A1200%2C%22language%22%3A%22en-US%22%7D&jsoncallback=json_rr1&beaconRequest=true&beaconStateChangeEvent=pagehide

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

24 Cookies

Domain/Path Name / Value
.irsfreshstart.org/ Name: __cf_bm
Value: UpqXfGzEj95FTGfCKmti0ZX1XMXZI48s57xM9XuN6GA-1700578501-0-AYoPsT6E4I0EwocW0ZExmf39PM1RefUInzwN7oIFXvxv74YDzfwAMrBFys5aZxfXiT7DvbJjiV1fSlTv+4BHKTk=
.irsfreshstart.org/ Name: _gcl_au
Value: 1.1.1464747674.1700578501
.irsfreshstart.org/ Name: _gid
Value: GA1.2.661488612.1700578501
.irsfreshstart.org/ Name: _gat_UA-187141017-1
Value: 1
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.irsfreshstart.org/ Name: _ga
Value: GA1.1.435981570.1700578501
.irsfreshstart.org/ Name: _cq_duid
Value: 1.1700578501.3VqfOZptoQpcqUpL
.irsfreshstart.org/ Name: _cq_suid
Value: 1.1700578501.T1QEdSCxHbhljbiu
obseu.bzcclandlord.com/ Name: cg_uuid
Value: 90a759cb681f4f8f002c271d3ccea419
.irsfreshstart.org/ Name: _fbp
Value: fb.1.1700578501516.623867747
.bing.com/ Name: MUID
Value: 1D87994EE81E612B1A248A9EE9CC6055
.irsfreshstart.org/ Name: _uetsid
Value: f2793d20887d11ee80fc41ef6458567e
.irsfreshstart.org/ Name: _uetvid
Value: f2797170887d11ee8f25c122340467b0
www.clarity.ms/ Name: CLID
Value: e6e8e4aa6bb44926a9d10a5661a9827e.20231121.20241120
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 1D87994EE81E612B1A248A9EE9CC6055
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 1D87994EE81E612B1A248A9EE9CC6055
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0
irsfreshstart.org/ Name: _cheq_rti_en
Value: TNtmCQzGfj5J4t2mGwHY7xYIof8%3DtHxJ6xJSPhcfH60WYyTJ1w9VOURey1%2BOAnr55dGrMhs8WnDXS0rq4W06UrZsPO5moK6cC7JPpwxJ4%2FSAShq9Kss625eT3AzEzqdXVXGqKqqLzKwhYiwBc%2Fx0bVyoiBCo1zE%3D
irsfreshstart.org/ Name: _cheq_rti
Value: TNtmCQzGfj5J4t2mGwHY7xYIof8=tHxJ6xJSPhcfH60WYyTJ1w9VOURey1+OAnr55dGrMhs8WnDXS0rq4W06UrZsPO5moK6cC7JPpwxJ4/SAShq9Kss625eT3AzEzqdXVXGqKqqLzKwhYiwBc/x0bVyoiBCo1zE=
.irsfreshstart.org/ Name: _ga_6FENPCF6Z2
Value: GS1.1.1700578501.1.0.1700578503.0.0.0
.irsfreshstart.org/ Name: invoca_session
Value: %7B%22ttl%22%3A%222023-12-21T14%3A55%3A03.179Z%22%2C%22session%22%3A%7B%22invoca_id%22%3A%22i-a972857a-e623-4772-d053-2429427442ad%22%7D%2C%22config%22%3A%7B%22ce%22%3Atrue%2C%22fv%22%3Afalse%2C%22rn%22%3Afalse%2C%22ba%22%3Atrue%7D%7D

1 Console Messages

Source Level URL
Text
network error URL: https://irsfreshstart.org/thank-you-1/?outcome=success&clickcease=block
Message:
Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.trustedform.com
bat.bing.com
c.bing.com
c.clarity.ms
cdn.trustedform.com
connect.facebook.net
googleads.g.doubleclick.net
irsfreshstart.org
obseu.bzcclandlord.com
pnapi.invoca.net
region1.google-analytics.com
solutions.invocacdn.com
use.typekit.net
www.clarity.ms
www.clickcease.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
bat.bing.com
pnapi.invoca.net
region1.google-analytics.com
141.193.213.10
143.204.98.44
2001:4860:4802:34::36
2600:9000:206f:4000:15:a0d3:77c0:93a1
2600:9000:223d:8a00:1c:7f1a:6680:93a1
2620:1ec:46::45
2620:1ec:c11::200
2a00:1450:4001:80e::2008
2a00:1450:4001:830::200e
2a00:1450:4001:831::2002
2a02:26f0:480:f::213:7ec6
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
2a05:d018:56f:b800:f42c:e894:1fb0:3740
3.225.185.199
68.219.88.97
028fd486b23216a6ba8063892ebc84f8621c75c5f3e88eac1703ae74d244117e
03814d897519169605126a08ee572e152e72dee27754b169c0dad3ae53d4185a
057851f67d2bfc349564c5b26853eced2bfffd54e0feb7e0938e6a26fe6fe4b9
0b1ec6ff5019b807e78eb419b28bf477ccd1c91be8c4725aadfcfdd66d2a4f9e
0d882d47e8abafdaa4c120e04db3a8f7b19ae91967d25c828f1bb21f41c78e2f
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1f796a4e99a9a921a3f021b20e5221a9d0cf0e5af5da91f1f4a8fe2ac183422b
330af621c43b64a90da3bcbf1ffbdfd2bdae8becd5e8a0585ea67d95e1240fc0
35cbf6a6e5e7ff72ebb142669e1727de048df4fc13fc9fb5d9bd2d8334de7a71
39f3150d3f0e4e61467e4e5f69a66f9f475ca887e326d719ae386093fe7fe2c1
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
4e2f8548007f7aaa9cb8fafb7c1e2a9cec5dc429fd7a4c92d66402aadda700a9
525db5b8f264bbcab367ab4eb35c89bea0dabfb1cba3878d3678eac665747678
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
5eccfe0d16ada5f79c41d282ded38ac2810c282358078c39cc6eaa6eb6687be1
6759a429a6cb3b659f255988622200afb4ceeb78f0e6e0eee44de205d550182d
6aa827a066e425152874c0830a601b478857e276d66085393038d818e00740cb
6cb7d82e3246ec364e787757bedb25e9001ab8cc6a1dcbb671a480837c9c0a40
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
8333bdf68e2b6ae5b641a9eaa01ae0c29c92b5b4707691e196b5c95ff006d71a
84ff1d86d234e297b080d37adc1056cdd8d9a0990b0dcf98960df39eb366458d
889794fd02992011c4b843a05190531656d4c6148e6d4375be6bab3432b580d0
891702d58f361236b2c02c1b20d61fce53b1a580943542c5e3dbfe1980150f81
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
98d91918017fa4245876e7869a2c224c064460f81c29e6cc5c4045f25f9e3685
9c42508c8ef28c3e242d3a9dad65b348d9417c14252ea34b44c5932d57108bc7
a5415b9f8b41969cb75676e0ead407fc311249273f89d396f660333c4faf9aa5
ae7b079f256a2f6d6382309cbf7cbb02ebc119cdcaab892c4fcd7ad82cb3499d
b6e7ebc7c4aeb37b5c218ab6c3610be5f5b1780fc955b13f0249ecc35c2e7549
b81b1818b1e8764100e82c29b40a4ed69eaee14eb1ad85850dc11eadfd530b99
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855