urlscan.io logo urlscan.io
SecurityTrails logo

declineoffering.com Open in urlscan Pro
2a06:98c1:3121::3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://tangismedia.site/rd#c5098Cimpk989736Xbei359991fGW3938uJZT952
Effective URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Submission: On January 02 via manual from FR — Scanned from FR
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 32 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is declineoffering.com.
TLS certificate: Issued by E1 on December 30th 2022. Valid for: 3 months.
This is the only time declineoffering.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Customer Survey Spam (Consumer)

Domain & IP information

IP Address AS Autonomous System
2 3 51.81.83.30 16276 (OVH)
1 141.98.5.67 8100 (ASN-QUADR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
25 2a06:98c1:312... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2001:4860:480... 15169 (GOOGLE)
32 7
3    51.81.83.30 (United States)

ASN16276 (OVH, FR)
PTR: vps-d2339296.vps.ovh.us
tangismedia.site
1    141.98.5.67 (Bulgaria)

ASN8100 (ASN-QUADRANET-GLOBAL, US)
antelopejump.com
1    2606:4700:3030::ac43:89f3 (United States)

ASN13335 (CLOUDFLARENET, US)
annualhelmet.info
25    2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)
declineoffering.com
event.trk-epicurei.com
2    2a00:1450:400d:807::2008 (Ireland)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:400d:805::200a (Ireland)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a06:98c1:3121::c (United States)

ASN13335 (CLOUDFLARENET, US)
trk-epicurei.com
1    2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
Apex Domain
Subdomains		 Transfer
21 declineoffering.com
declineoffering.com
5 MB
5 trk-epicurei.com
trk-epicurei.com — Cisco Umbrella Rank: 133310
event.trk-epicurei.com — Cisco Umbrella Rank: 194890
3 KB
3 tangismedia.site
tangismedia.site
733 B
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 123
116 KB
1 google-analytics.com
region1.google-analytics.com — Cisco Umbrella Rank: 2124
340 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 127
1 KB
1 annualhelmet.info
annualhelmet.info
702 B
1 antelopejump.com
antelopejump.com
426 B
32 8
Domain Requested by
21 declineoffering.com antelopejump.com
declineoffering.com
4 event.trk-epicurei.com trk-epicurei.com
3 tangismedia.site 2 redirects
2 www.googletagmanager.com declineoffering.com
www.googletagmanager.com
1 region1.google-analytics.com www.googletagmanager.com
1 trk-epicurei.com declineoffering.com
1 fonts.googleapis.com declineoffering.com
1 annualhelmet.info 1 redirects
1 antelopejump.com tangismedia.site
32 9

This site contains no links.

Subject Issuer Validity Valid
antelopejump.com
R3		 2022-12-24 -
2023-03-24		 3 months crt.sh
*.declineoffering.com
E1		 2022-12-30 -
2023-03-30		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
*.trk-epicurei.com
E1		 2022-12-10 -
2023-03-10		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Frame ID: 8C9438E3112BB94DE500A7A27E6BF88B
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

[1] Récompense en attente - Carrefour - Nous voulons votre avis!

Page URL History Show full URLs

  1. http://tangismedia.site/rd HTTP 301
    http://tangismedia.site/rd/ Page URL
  2. http://tangismedia.site/track/c5098Cimpk989736Xbei359991fGW3938uJZT952 HTTP 302
    https://antelopejump.com/0/0/0/d48e7fa2e97257ceb95c08c46503f33f/15/952-5098/989736-359991-3938 Page URL
  3. https://annualhelmet.info/?s1=351071&s2=889278407&s3=4947&s4=1&s10=2019 HTTP 302
    https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

32
Requests

97 %
HTTPS

75 %
IPv6

8
Domains

9
Subdomains

7
IPs

3
Countries

5664 kB
Transfer

6546 kB
Size

5
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://tangismedia.site/rd HTTP 301
    http://tangismedia.site/rd/ Page URL
  2. http://tangismedia.site/track/c5098Cimpk989736Xbei359991fGW3938uJZT952 HTTP 302
    https://antelopejump.com/0/0/0/d48e7fa2e97257ceb95c08c46503f33f/15/952-5098/989736-359991-3938 Page URL
  3. https://annualhelmet.info/?s1=351071&s2=889278407&s3=4947&s4=1&s10=2019 HTTP 302
    https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://tangismedia.site/rd HTTP 301
  • http://tangismedia.site/rd/
Request Chain 1
  • http://tangismedia.site/track/c5098Cimpk989736Xbei359991fGW3938uJZT952 HTTP 302
  • https://antelopejump.com/0/0/0/d48e7fa2e97257ceb95c08c46503f33f/15/952-5098/989736-359991-3938

32 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
tangismedia.site/rd/
Redirect Chain
  • http://tangismedia.site/rd
  • http://tangismedia.site/rd/
243 B
360 B 		Document
General
Check archive.org
Download Go to
Full URL
http://tangismedia.site/rd/
Protocol
HTTP/1.1
Server
51.81.83.30 , United States, ASN16276 (OVH, FR),
Reverse DNS
vps-d2339296.vps.ovh.us
Software
/
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

Content-Length
243
Content-Type
text/html; charset=utf-8
Date
Mon, 02 Jan 2023 15:25:44 GMT

Redirect headers

Content-Length
39
Content-Type
text/html; charset=utf-8
Date
Mon, 02 Jan 2023 15:25:44 GMT
Location
/rd/
989736-359991-3938
antelopejump.com/0/0/0/d48e7fa2e97257ceb95c08c46503f33f/15/952-5098/
Redirect Chain
  • http://tangismedia.site/track/c5098Cimpk989736Xbei359991fGW3938uJZT952
  • https://antelopejump.com/0/0/0/d48e7fa2e97257ceb95c08c46503f33f/15/952-5098/989736-359991-3938
134 B
426 B 		Document
General
Check archive.org
Download Go to
Full URL
https://antelopejump.com/0/0/0/d48e7fa2e97257ceb95c08c46503f33f/15/952-5098/989736-359991-3938
Requested by
Host: tangismedia.site
URL: http://tangismedia.site/rd/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
141.98.5.67 , Bulgaria, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
http://tangismedia.site/rd/#c5098Cimpk989736Xbei359991fGW3938uJZT952
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

content-length
134
content-type
text/html; charset=UTF-8
date
Mon, 02 Jan 2023 15:25:46 GMT
server
Apache

Redirect headers

Content-Length
117
Content-Type
text/html; charset=utf-8
Date
Mon, 02 Jan 2023 15:25:45 GMT
Location
https://antelopejump.com/0/0/0/d48e7fa2e97257ceb95c08c46503f33f/15/952-5098/989736-359991-3938
Primary Request c30c7a371ee8b606b7caf1064f7b2472
declineoffering.com/
Redirect Chain
  • https://annualhelmet.info/?s1=351071&s2=889278407&s3=4947&s4=1&s10=2019
  • https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
356 KB
49 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Requested by
Host: antelopejump.com
URL: https://antelopejump.com/0/0/0/d48e7fa2e97257ceb95c08c46503f33f/15/952-5098/989736-359991-3938
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc040790f8630632d487eccb7fb20457deac915bbb86fc6b8d96996ef6d7336c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://antelopejump.com/0/0/0/d48e7fa2e97257ceb95c08c46503f33f/15/952-5098/989736-359991-3938
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
fr-FR,fr;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7834825fa80999a4-CDG
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 02 Jan 2023 15:25:47 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Um3AD8WlJNSCr6f4plFPb%2F4LXPBb8tJCBQpuRWLKcofhzy%2BSB3ynNYA8rMg96VNCf9NtLLP%2B7tQ4QMZ6%2BeN7G8j3%2B7E5ohg%2FBwBv7xDIBb7NTKMZzJX4ldJs2h2%2FRWnItLq0%2FKk65M6IKwMPYS75Ayyq"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
no-cache, no-store, must-revalidate, max-age=0
cf-cache-status
DYNAMIC
cf-ray
7834825d4de52a19-CDG
content-type
text/html; charset=UTF-8
date
Mon, 02 Jan 2023 15:25:46 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MYVkTwJSRQToWVIcs4pEWVKlZ0qF40OCBvoR%2BP6kxO8Wx19%2F4yfnJYVTfk8o%2BUiQ0FzPMhESIAtAxuyU6EZp2ckGtf0mGYpIdscRt8Awh8FjuE%2FrcZYCATnm4OOpx5WRJ6MGjQRz4x7zW4yJ%2BlwPlw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
User-Agent,User-Agent
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
bootstrap.min.css
declineoffering.com/assets/vendors/bootstrap-4.5.3/css/ 		157 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/assets/vendors/bootstrap-4.5.3/css/bootstrap.min.css
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
154892
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 20 Aug 2021 13:04:53 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QxIBu%2BMwV6clBRxdFQJgyGXbsYXZXeweiznTkP2Pfck4wuoG6Lui%2BZTznGITf1bI7xIyTNbNPa7vQT08laRMf4FtY%2BsD%2FS%2FKdlOKG6tApb7XIIs4JwjK588sKkMuvf8IIA0qk2nHrMJuA68Iwh1u10qX"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
783482645e8699a4-CDG
expires
Sat, 07 Jan 2023 20:24:15 GMT
all.css
declineoffering.com/assets/vendors/fontawesome/css/ 		72 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/assets/vendors/fontawesome/css/all.css
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
462beb0c8ecb2abb15685c31875f268d166313581df110401c2483fab24a46df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
154892
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Mon, 19 Jul 2021 19:01:59 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n4dUbRzl216zV1FJthDulvkhXEcBtcApgIVuqsyHfLasbq4uKS4hH5z%2FNzVVuQIKxUiNwjerlHjaVTPldf5mGmEdZSVRbZAsy8EnsyS5%2BwnV6bkUC5su2uYeQfazYElF8wKGqm4B2w0HQDuU9mEpCiay"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
783482645e8b99a4-CDG
expires
Sat, 07 Jan 2023 20:24:15 GMT
common.css
declineoffering.com/assets/css/dublin/ 		37 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/assets/css/dublin/common.css?v=c293c39255953f6a79ba3a0a60933236
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
163eb1b56d0ca6f85ba1f1d795e5e5add033afffc1ca8ec16d4de999c4f05d5f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 13 Dec 2022 18:52:38 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/css
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZH5XMf6MNM%2BDPoC%2B1Q2Zemeazqhk%2Fpdp%2F9w%2BXrzAyj7PDGD9yCx346xNGz3cFA8KeUAVQS%2BlPeKiEtPQ90gPjXjf8EqNA3jTizixV85LK4s9PZi9uBvzoGhRbHvNIQ8FayJ7aPFI18DAiCsTpKuEL4yf"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
783482645e8d99a4-CDG
expires
Mon, 09 Jan 2023 15:25:47 GMT
msg.js
declineoffering.com/inc/ 		942 B
800 B 		Script
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/inc/msg.js
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06c3f3452108be85c9304eb8e6fc6dc831534e12362cfd03afd47f4320f894a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
154892
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 20 Oct 2022 12:25:37 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S1YxtRavTapLoGgSZNt64T%2BHJwA7pv%2F8Q50PhQfxK0jZgxRsgWiuMdKPepT1%2B9iXk6M%2F6nAlSmuG2DV%2F5hRlF4B%2BVT8BIcoZihuuAv8NNag4L44Y84WOA%2FzweHZIRuR1MuqWaEmvSpYd%2B5l4OfLr7mlN"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
783482645e8f99a4-CDG
expires
Sat, 07 Jan 2023 20:24:15 GMT
gtm.js
www.googletagmanager.com/ 		106 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NK3N874
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:807::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a25f015635729ac301e21819dfa43043b69d848afe985b4050d1d57698c4aad3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41856
x-xss-protection
0
last-modified
Mon, 02 Jan 2023 15:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 02 Jan 2023 15:25:47 GMT
jquery-3.4.1.min.js
declineoffering.com/assets/vendors/ 		86 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/assets/vendors/jquery-3.4.1.min.js
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
154870
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 20 Aug 2021 13:04:53 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yb%2Fdh%2BMOW997AuMUbTiVtwLvu5l1fwMllnR0zJ7ApnpY4jtHTkKsOSXbpYC5wbQAdDG8Tu60ms4PAZDhTEUf5Suv8MGEFiFNWG1zeOD%2BXtCjitfRijo5jWeOvBSZB7QfYoPtQgcFG3CmMdJmH8o9Q0ag"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
78348264f91d2a77-CDG
expires
Sat, 07 Jan 2023 20:24:37 GMT
bootstrap.min.js
declineoffering.com/assets/vendors/bootstrap-4.5.3/js/ 		62 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/assets/vendors/bootstrap-4.5.3/js/bootstrap.min.js
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
154870
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Fri, 20 Aug 2021 13:04:53 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cvEQqWogKZcOQSyaLaclEt0bdfGk2T0chyuDzYFh%2FeFttO9pKJstFD0iv9Q1Lm6Ka0iKCLIHZNzjypGgqOnV9Q0bb2uidWnnAfMoca9zEbQZKVRvQO%2FlgyQLIujqbO8pIjAhMaefvfbidf7PFXKwns5A"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
78348264f9272a77-CDG
expires
Sat, 07 Jan 2023 20:24:37 GMT
functions.js
declineoffering.com/assets/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/assets/js/functions.js?v=c293c39255953f6a79ba3a0a60933236
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5de7a79e14562963ef11f0d95f7a098e3cc018347a95290e292bef9b7d4677b5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 06 Sep 2022 14:55:28 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nrBV4%2B0uAV4D1U%2BLJAeP54mH%2Ffy%2Ftui2TluZdxIP0V%2FCooiVeX4uh6I7lYgA5qMl3jPggvHCeDGiOjqQQ7goAIrVdiziwbbuc18buk4MBKZuZrB%2BRnK4hiXoGirpxIqYjAdbL3QYYZk1zcg0o140apNo"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
78348264f92a2a77-CDG
expires
Mon, 09 Jan 2023 15:25:47 GMT
intl_functions.js
declineoffering.com/assets/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/assets/js/intl_functions.js?v=c293c39255953f6a79ba3a0a60933236
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7077430b976a181d99efafc06e7e29923636aa84041bdd06c78fce5d960bb074
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 15 Sep 2022 19:29:38 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nMxARMWUgrfnx9e1WCYzypUPMQIz0PrSXaf%2FOowJHCJue7xFUIrKQrqKgH9yGLMYoUmKMG28Y87VX4%2BuXjOdn68dPLLtbHNLgaPSdQvjv%2FGvPS6gZ9troV79X3PmHo4kguu6WVWRMlAsr0eF4WHLFa3y"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
78348264f92d2a77-CDG
expires
Mon, 09 Jan 2023 15:25:47 GMT
common.js
declineoffering.com/assets/js/dublin/ 		63 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/assets/js/dublin/common.js?v=c293c39255953f6a79ba3a0a60933236
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8d40dfe29cecd922e3bed842545f8d0736ad8d38c2423479753abf217de728d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 06 Dec 2022 21:27:20 GMT
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
application/javascript
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jnXt0hdUG4TfY3U5TyrUZmKNAsxsNxpnM80hhuLX56IRWFiqtsbLFKOX14PPKVDYdgz60qHUNf666zqoj1zoHWcP4VIyn6KZ9MKVbws%2BJDS37bAMTcLMpxyNklrOll5XQfd7cdc5FlNibQTiwO6f71My"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
cf-ray
78348264f9312a77-CDG
expires
Mon, 09 Jan 2023 15:25:47 GMT
css2
fonts.googleapis.com/ 		5 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Arimo:wght@500;700&display=swap
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/assets/css/dublin/common.css?v=c293c39255953f6a79ba3a0a60933236
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:805::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6f2de36054525c7a25f6b4ca1447f762169a97d0f11593cf0f8f254880f4c2bc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 02 Jan 2023 15:24:56 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 02 Jan 2023 15:25:47 GMT
js
www.googletagmanager.com/gtag/ 		213 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-JMJ044GLKX&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NK3N874
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400d:807::2008 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
fa9a319918c11160f66639c499bb7eadaa644a028f27adff87358abe35fd02cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:47 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
76255
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Mon, 02 Jan 2023 15:25:47 GMT
v9e118mez8
trk-epicurei.com/scripts/push/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trk-epicurei.com/scripts/push/v9e118mez8
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/inc/msg.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98471adcccb3e03718fba0789fd2ccfcc8c8aff1c1467aed50d21d5534526e90
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
DENY
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
content-type
application/javascript;charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sUNtYKw2nm7sp16ZEYIugcsVi%2FbNmae4DPGVjQ5bN9Y%2F%2FsBHoWlU7YzMceK76VBW0ReHRxy4Iy%2F9c8t2MILhfrAPxRdlLdkaIVZ708ig%2BnozfbTiquD1z11mgrL4FhOfmQ0i7Hg8Hcv0JfHuU2EW"}],"group":"cf-nel","max_age":604800}
cache-control
no-cache, no-store, max-age=0, must-revalidate
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'
cf-ray
78348266b99199c3-CDG
expires
0
36caa5dae0d0fd30d6e475f3135c2201.png
declineoffering.com/fim/2019-FR/ 		23 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/fim/2019-FR/36caa5dae0d0fd30d6e475f3135c2201.png
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
548bb83bffb33cf1eabfee1d411f478f44b9651617cf45285bb74216dbce9461
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4044
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
23413
x-xss-protection
1; mode=block
last-modified
Mon, 02 Jan 2023 13:45:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3qwu4tFw9N8jFwaaegOwloe4R%2FmfMEgz3%2FG9pPwnRqeuIdVm6rQJrUFvchhty%2BVxKVMWORkFu5VtigY0kAOyoBs8gRWzOjtnoCSy2CuC4Pb9212flVfSUUD4XA%2FGbAONsomiQoZLOykUgn5T3ujL%2F%2F0D"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482674d852a77-CDG
expires
Mon, 09 Jan 2023 14:18:24 GMT
16f77ec2d8ed597509d76456cbb7f528.png
declineoffering.com/fim/2019-FR/ 		13 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/fim/2019-FR/16f77ec2d8ed597509d76456cbb7f528.png
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
daaede23b88adfdab069eb1633cda9abb7326ecaff2207a8b5649f046fe86a76
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4041
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
13586
x-xss-protection
1; mode=block
last-modified
Mon, 02 Jan 2023 13:45:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EsBCU4xro7d3W1CzYrduZHdkz%2BdXoAB8Abyylp6gl8Wu3ambpB3ErBKdWWtEvcpEGqaA6hi8XGSoL78s%2BWvOeUDMAj8rTzoD3Lpdt7p7U%2BaIXXKlqsitkPdnfgUyy4RYc7r8cM6Fjewqmh%2FZxiOfRUCv"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482674d892a77-CDG
expires
Mon, 09 Jan 2023 14:18:27 GMT
7ca80a9132615a54780ba1bde89cd8d5.png
declineoffering.com/fim/2019-FR/ 		405 KB
405 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/fim/2019-FR/7ca80a9132615a54780ba1bde89cd8d5.png
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa53ce1573456f3e0e1a0ce195da84880fad14054e11fdfa79b6d4d870f73b98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4041
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
414521
x-xss-protection
1; mode=block
last-modified
Mon, 02 Jan 2023 13:45:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BrtBoXxXBJ8uTyDcxrVwqvDys%2BdXhfMDmFHQG3pq8bzpPzy7qioU9k0f%2BZ40TyzAgxfDqkm%2FUwAuH79T9%2B0dkTaEBOycZmYe9cjB36papiNBAGNBMpgrgkufLSPL1rAgXdH3Jo80lyc8X7TEbw53GVyb"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482674d8e2a77-CDG
expires
Mon, 09 Jan 2023 14:18:27 GMT
217d3a0f9497583b986dfc5d00762268.png
declineoffering.com/fim/2019-FR/ 		384 KB
385 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/fim/2019-FR/217d3a0f9497583b986dfc5d00762268.png
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb4713e7b7d754088b15afa907f5713d6a5865e05114487ce253f767c9b0d26a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3272
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
393194
x-xss-protection
1; mode=block
last-modified
Mon, 02 Jan 2023 13:46:23 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WNiiAeeVspQf8h3huRK7mCxK75WuDh6wPVwPd5i%2F7uNyjH7R8ZuJJNM8MpurC3qhdWPVe4LH0N%2Fd6uBpa95KfGtvLJRDSw0srjjord9IFGSJs0pvKX6H7h%2B7DyGJ80lVWJKCGFMrQYA51xk96RzsJAcg"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482674d8f2a77-CDG
expires
Mon, 09 Jan 2023 14:31:16 GMT
26690755c30d8868e2a24c168463b13a.png
declineoffering.com/fim/2019-FR/ 		822 KB
823 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/fim/2019-FR/26690755c30d8868e2a24c168463b13a.png
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c59a8e9d701d301a763bc11ad489cc34870a63ad3d41e6b6347b5b4050517bb0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
546
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
841551
x-xss-protection
1; mode=block
last-modified
Mon, 02 Jan 2023 14:09:39 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=niJyEd08e4%2FVspd1cL8x%2FS00NcYAnRNH78zy17H8GScQ%2FcjYv209GBoNs6uQxO0tHnr488357DavHHtLIaGclCAt2%2F38EYJHuLmAWncVJvjUSfu74JjHikkChjuTriE8jxzRz6GspGowBNlCzkgeAykT"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482674d902a77-CDG
expires
Mon, 09 Jan 2023 15:16:41 GMT
6340625732915851b4a1d2d9a8a909bb.png
declineoffering.com/fim/2019-FR/ 		566 KB
566 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/fim/2019-FR/6340625732915851b4a1d2d9a8a909bb.png
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
408f0cbb8d7e2a4cb44789232a1afaa702e3596a69dfd0bff01f50a00b0d4367
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
579123
x-xss-protection
1; mode=block
last-modified
Mon, 02 Jan 2023 14:20:50 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oXVF3z3FmGvBSxE22FtB4x%2FKpxiavpbS8MBqTUXqBV5YWfO2hBkmVVD0DNWoJg1B25svZmTnpwkl3rJft6M%2FzsRQBXR3gh32MvG%2BzisZpEQkMAyKhQnUm3jEv0R3IUErO%2BQg69Wy5p7NYSLYsmAj%2B8X2"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482674d912a77-CDG
expires
Mon, 09 Jan 2023 15:25:48 GMT
b82f677a48ac427bc31843e88d4ce296.png
declineoffering.com/fim/2019-FR/ 		1 MB
1 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/fim/2019-FR/b82f677a48ac427bc31843e88d4ce296.png
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
857133a9dceb3d7bf93fbaad72f5b6010016b0f9e084b3f62e3f357be177901e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4044
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1370432
x-xss-protection
1; mode=block
last-modified
Mon, 02 Jan 2023 13:45:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5suXq45XVeWEznc8d9AN9mwK0zVoedvjiXAoc4CYtZRmzi93rfb3T3nc3MxED%2BSR1qOtqw4VaV5%2BVqCmxhq8OJeSEc466AN5kwovdwPH1Wpu3MxdFwhqwR8an4Ij0MNImiV%2BI9ufbLbSWnECr%2FG8uQhv"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482674d932a77-CDG
expires
Mon, 09 Jan 2023 14:18:24 GMT
3b31f48401b6e17466fc03c90bef27f2.png
declineoffering.com/fim/2019-FR/ 		2 MB
2 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/fim/2019-FR/3b31f48401b6e17466fc03c90bef27f2.png
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d335d35caade2430e451afbf33599d0c3f434f6f69966f469ef609493341f0a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1715826
x-xss-protection
1; mode=block
last-modified
Mon, 02 Jan 2023 13:45:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=264D6Gb%2FoJVP%2FAeTO56kcCXNn6KGeI8PrzyqI%2Fmaw6W0mnlJVBnmYbti8EMfqVO%2F5z2r44UghMvhhYm92ZcYmTJoax93pA5NPhWmBorRApe5XgXJTamE7T3YaI7p53R1TSNcYGiQ8nIKoZS0IFB5luRa"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482674d942a77-CDG
expires
Mon, 09 Jan 2023 15:25:48 GMT
215aba84aa2f23170696406a3118511e.png
declineoffering.com/fim/2019-FR/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/fim/2019-FR/215aba84aa2f23170696406a3118511e.png
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4041
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5389
x-xss-protection
1; mode=block
last-modified
Mon, 02 Jan 2023 13:45:43 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
image/png
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O4O9EiqvvukhS5KyTfH1oNmj%2BFUxS8p7SmrKx5khqcZgJ3MOtbQXnIpBYVr9rBCBo%2F1S7%2FeHVK0Z%2B56%2BBNxWTuToSgCtLlEyycumyVjLb48X0b7RFg4wvRttyxvxPTBhOkpjQjx9oWmMhsG8uhafakkA"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482674d962a77-CDG
expires
Mon, 09 Jan 2023 14:18:27 GMT
c30c7a371ee8b606b7caf1064f7b2472
declineoffering.com/ 		64 KB
64 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection
1; mode=block
pragma
no-cache
server
cloudflare
vary
Accept-Encoding,User-Agent,User-Agent
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0xQ5taS6gdiPHJJnNZ7mjEk9h70f6bKHKfKsmQg4SL4pV54qCAWFbLbKnaWlFdBonEECSNc315oT51fHzH61XxKiyrF49Nqm97I9w4lQ9IcA16Ncdlig%2BX29m0ZjUmK%2BA5XbPjEFYA9BFHCj3s7T2G6m"}],"group":"cf-nel","max_age":604800}
cache-control
no-store, no-cache, must-revalidate
cf-ray
783482677de82a77-CDG
expires
Thu, 19 Nov 1981 08:52:00 GMT
fa-solid-900.woff2
declineoffering.com/assets/vendors/fontawesome/webfonts/ 		78 KB
79 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://declineoffering.com/assets/vendors/fontawesome/webfonts/fa-solid-900.woff2
Requested by
Host: declineoffering.com
URL: https://declineoffering.com/assets/vendors/fontawesome/css/all.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c916669cf923b4f1b2db5c5107c83b6ca205e7ad0dcd840b251e63f0c8d28a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://declineoffering.com/assets/vendors/fontawesome/css/all.css
Origin
https://declineoffering.com
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Mon, 02 Jan 2023 15:25:48 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
154870
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
80252
x-xss-protection
1; mode=block
last-modified
Mon, 19 Jul 2021 19:01:59 GMT
server
cloudflare
x-frame-options
SAMEORIGIN
vary
User-Agent,User-Agent, Accept-Encoding
content-type
font/woff2
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7XUe4BoIeXhjHgL8hbMT4XwjCicNF7BCtsxGSA%2BpDOGnaJHYQeYfZxae%2BTqh25eKUlRX1IgJGZ56%2BTcHAyDw3cMEqNM8wmaJGXMJMdO5wM47tj92fZAvwvT7FLbtlDezPr%2BN6ly56khRcBRDxNpMz80%2B"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=604800
accept-ranges
bytes
cf-ray
783482678dea2a77-CDG
expires
Sat, 07 Jan 2023 20:24:38 GMT
collect
region1.google-analytics.com/g/ 		0
340 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-JMJ044GLKX&gtm=2oebu0&_p=1014044691&cid=1175036185.1672673148&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1672673148&sct=1&seg=0&dl=https%3A%2F%2Fdeclineoffering.com%2Fc30c7a371ee8b606b7caf1064f7b2472&dr=https%3A%2F%2Fantelopejump.com%2F&dt=%5B1%5D%20R%C3%A9compense%20en%20attente%20-%20Carrefour%20-%20Nous%20voulons%20votre%20avis!&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-JMJ044GLKX&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
fr-FR,fr;q=0.9
Referer
https://declineoffering.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 02 Jan 2023 15:25:48 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://declineoffering.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
v9e118mez8
event.trk-epicurei.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-epicurei.com/register/event_log/v9e118mez8
Requested by
Host: trk-epicurei.com
URL: https://trk-epicurei.com/scripts/push/v9e118mez8
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://declineoffering.com/
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-type
application/json

Response headers

expires
0
date
Mon, 02 Jan 2023 15:25:51 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
DENY
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NKNA5o56ze3BfrysAvJsPtgBdnjgh6k6ck%2BpB6td9yWojgC1ZPX%2FcXAw95pZOkkw9poc8VfWqgRSdb2KZPhwlPknV%2FZ4arOwoJ0lQ5xYRona%2FP2ns0wKie2hkoC0Q4zI6EZz1eTo9FaMoQz5RFAv5vR5Bczz"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://declineoffering.com
access-control-expose-headers
Authorization, Link, X-Total-Count
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'
cf-ray
7834827c1e0fd231-CDG
x-pushplatformapp-params
v9e118mez8
event.trk-epicurei.com/register/event_log/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-epicurei.com/register/event_log/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://declineoffering.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://declineoffering.com
access-control-expose-headers
Authorization, Link, X-Total-Count
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7834827acd00f0b7-CDG
content-length
0
date
Mon, 02 Jan 2023 15:25:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nbjARHIbdivpjuaB6IGOb1B0NchXQMi2VrT1vnbyvNbLGhn%2FP0M468pf75yOBFjAngMKCPDGbJOp%2FEMUqHxyK%2BYotSn6dE5cAVsmdKVlOCV9fzmQ5wnPU%2BPPBvv713%2F987JyQ0jMFs6o1UbzBu6blIc2wwlH"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
v9e118mez8
event.trk-epicurei.com/register/event_log/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://event.trk-epicurei.com/register/event_log/v9e118mez8
Requested by
Host: trk-epicurei.com
URL: https://trk-epicurei.com/scripts/push/v9e118mez8
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://declineoffering.com/
accept-language
fr-FR,fr;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-type
application/json

Response headers

expires
0
date
Mon, 02 Jan 2023 15:25:51 GMT
content-security-policy
default-src 'self'; frame-src 'self' data:; connect-src 'self' https://cdn-media-2020.s3.amazonaws.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' 'unsafe-inline'; img-src https://* data:; font-src 'self' data:
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-pushplatformapp-alert
pushPlatformApp.pushSubscription.deleted
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
x-xss-protection
1; mode=block
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
DENY
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oKn7fUknt99KtxUCZfhwzSN%2F%2BrjQ9LUIpOwSLb%2FVanwuwLxgW%2BMKAfqlcuS0FjlnrwTf1l9XnY0W8RUKCQenxKjxMiXlFc1ha%2FE%2BbBC8Z3Hk3aQBhu0AONGtshTd1EtdScBHUcQfOKGo0BSbLB37gZj8r1Un"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
https://declineoffering.com
access-control-expose-headers
Authorization, Link, X-Total-Count
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
feature-policy
geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'
cf-ray
7834827bcdc2d231-CDG
x-pushplatformapp-params
v9e118mez8
event.trk-epicurei.com/register/event_log/ 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://event.trk-epicurei.com/register/event_log/v9e118mez8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://declineoffering.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
content-type
access-control-allow-methods
POST
access-control-allow-origin
https://declineoffering.com
access-control-expose-headers
Authorization, Link, X-Total-Count
access-control-max-age
1800
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7834827acd04f0b7-CDG
content-length
0
date
Mon, 02 Jan 2023 15:25:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NQ8Sztw62auZ9522uhdW8FKpO8DpiksnvuMQAF9KRqoc0xM1SVgYbu6VkXuAdWzFys2xiJNC6Uc8f5ScO9sWWM6zpTsK4Z0pyEXSsIhVbq8uHSRtEamJZu%2BA%2F0jp9uNrA%2F8J5s%2FPJa772tSa4sBZ596OOmPZ"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Customer Survey Spam (Consumer)

130 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange object| dataLayer object| google_tag_manager object| google_tag_data object| MYCALL string| s1 string| s2 string| esource string| pshpub string| pshdomain object| _0xc61e function| _0xe74c function| $ function| jQuery object| bootstrap function| datehax function| startTimer number| duration object| _0xc51e function| _0xe59c string| rightnow string| imageSquare object| currentdate object| months function| startINTSurvey function| startQuestion function| startSurveyDub function| showSurveyDub object| _0xc34e function| _0xe50c string| LNG string| CMP string| CNT string| BID string| API_URL string| attrChoices string| domain number| count string| pipeline string| zipcode string| state_selected boolean| processing object| states function| birthdayFill function| beforeShowQuestion function| showOfferWall function| createQuestion function| processQuestion function| nextQuestion function| replaceUrlParam function| popunder function| startsurvey number| box_trying boolean| oneclick function| formatPhoneNumber function| switchTypeQuestions function| validatePhone function| validateEmail function| validateZip function| sendZipIp function| validateHeightF function| validateHeightI function| validateWeight function| validateAll function| validateName function| validateLName function| validateBirthday function| days function| daysInMonth function| dashedNumber function| alpha function| validateKeyStrokes function| showStreetState function| leadgenForm function| overflowP function| showDisclaimer function| preventS function| comment function| like function| startSurveyU function| createQuestionU function| switchTypeQuestionsU function| nextQuestionU function| validateData function| showStreetStateU function| showModal function| showOfferWallU object| _0xc66e function| _0xe22c string| aff_id string| click_id string| Brand string| lpid string| lpow object| prepop string| emailURL string| phoneURL string| zipcodeURL string| cityURL string| stateURL string| questiontx string| of string| languageCode string| countryCode string| popUrl object| _0xc52e function| _0xe87c number| answered number| prevProgress number| stepsTotal number| progress string| cheerstx string| txt function| cheers function| urlBase64ToUint8Array function| pullUrlParams function| push_subscribe function| push_subscribe_promise function| setIfNull function| logPushEvent function| push_unsubscribe function| push_init function| setSessionId function| setUtm function| getSessionId function| getUrlVars function| getDomainName function| getStore function| onYouTubeIframeAPIReady object| gaGlobal

5 Cookies

Domain/Path Name / Value
antelopejump.com/ Name: uid4947
Value: 889278407-20230102102546-f8babf4f52104a178ad23cb01510e992-
annualhelmet.info/ Name: PHPSESSID
Value: 86e5430f2614995094f564ee554d0c6a
declineoffering.com/ Name: PHPSESSID
Value: 4c6714578fc0877140d1d2e0818c3df8
.declineoffering.com/ Name: _ga_JMJ044GLKX
Value: GS1.1.1672673148.1.0.1672673148.0.0.0
.declineoffering.com/ Name: _ga
Value: GA1.1.1175036185.1672673148

1 Console Messages

Source Level URL
Text
other error URL: https://declineoffering.com/c30c7a371ee8b606b7caf1064f7b2472
Message:
Chrome currently does not support the Push API in incognito mode (https://crbug.com/401439). There is deliberately no way to feature-detect this, since incognito mode needs to be undetectable by websites.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

annualhelmet.info
antelopejump.com
declineoffering.com
event.trk-epicurei.com
fonts.googleapis.com
region1.google-analytics.com
tangismedia.site
trk-epicurei.com
www.googletagmanager.com
141.98.5.67
2001:4860:4802:32::36
2606:4700:3030::ac43:89f3
2a00:1450:400d:805::200a
2a00:1450:400d:807::2008
2a06:98c1:3121::3
2a06:98c1:3121::c
51.81.83.30
06c3f3452108be85c9304eb8e6fc6dc831534e12362cfd03afd47f4320f894a3
163eb1b56d0ca6f85ba1f1d795e5e5add033afffc1ca8ec16d4de999c4f05d5f
3d335d35caade2430e451afbf33599d0c3f434f6f69966f469ef609493341f0a
408f0cbb8d7e2a4cb44789232a1afaa702e3596a69dfd0bff01f50a00b0d4367
462beb0c8ecb2abb15685c31875f268d166313581df110401c2483fab24a46df
4c24dfd28784ad2befb3dafaac6bf1ed4e7cd58cce713d9a0b228d426e812baf
548bb83bffb33cf1eabfee1d411f478f44b9651617cf45285bb74216dbce9461
5de7a79e14562963ef11f0d95f7a098e3cc018347a95290e292bef9b7d4677b5
6c916669cf923b4f1b2db5c5107c83b6ca205e7ad0dcd840b251e63f0c8d28a2
6f2de36054525c7a25f6b4ca1447f762169a97d0f11593cf0f8f254880f4c2bc
7077430b976a181d99efafc06e7e29923636aa84041bdd06c78fce5d960bb074
857133a9dceb3d7bf93fbaad72f5b6010016b0f9e084b3f62e3f357be177901e
98471adcccb3e03718fba0789fd2ccfcc8c8aff1c1467aed50d21d5534526e90
a25f015635729ac301e21819dfa43043b69d848afe985b4050d1d57698c4aad3
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
c59a8e9d701d301a763bc11ad489cc34870a63ad3d41e6b6347b5b4050517bb0
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
d8d40dfe29cecd922e3bed842545f8d0736ad8d38c2423479753abf217de728d
daaede23b88adfdab069eb1633cda9abb7326ecaff2207a8b5649f046fe86a76
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
fa53ce1573456f3e0e1a0ce195da84880fad14054e11fdfa79b6d4d870f73b98
fa9a319918c11160f66639c499bb7eadaa644a028f27adff87358abe35fd02cf
fb4713e7b7d754088b15afa907f5713d6a5865e05114487ce253f767c9b0d26a
fc040790f8630632d487eccb7fb20457deac915bbb86fc6b8d96996ef6d7336c