citizenmj.com Open in urlscan Pro
172.86.75.147  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

40 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response citizenmj.com/	12 KB 12 KB	297ms 30ms	Document text/html	172.86.75.147 BLNWX
General Check archive.org Show headers Download Go to Full URL https://citizenmj.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 172.86.75.147 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx/1.20.1 / Resource Hash db0822715644c1bdeae42bf2525e49ce3e35ae2335c9bdd9a534ed706885e4c8 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 12150 Content-Type text/html Date Mon, 03 Apr 2023 14:44:10 GMT ETag "6420f3a2-2f76" Last-Modified Mon, 27 Mar 2023 01:38:42 GMT Server nginx/1.20.1
GET H2	200	css fonts.googleapis.com/	8 KB 1 KB	77ms 29ms	Stylesheet text/css	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:300,400,500,700 Requested by Host: citizenmj.com URL: https://citizenmj.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 8cb00b3db2e68ae430cd96730d426b74a42cd138f3f2475564861aa1fdda0888 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Mon, 03 Apr 2023 14:44:11 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 03 Apr 2023 14:20:46 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 03 Apr 2023 14:44:11 GMT
GET H/1.1	200 OK	index.css citizenmj.com/css/	20 KB 21 KB	16ms 15ms	Stylesheet text/css	172.86.75.147 BLNWX
General Check archive.org Show headers Download Go to Full URL https://citizenmj.com/css/index.css Requested by Host: citizenmj.com URL: https://citizenmj.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 172.86.75.147 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx/1.20.1 / Resource Hash fc8cec1406d4fb7fdb48e0c4897503b653db7d835c60dc1f61d5b8c86666b0bc Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 14:44:11 GMT Last-Modified Mon, 27 Mar 2023 01:38:40 GMT Server nginx/1.20.1 ETag "6420f3a0-5145" Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 20805
GET H2	200	content a.cnsmrvrfy.com/	807 B 1 KB	521ms 166ms	Image image/gif	45.60.1.61 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://a.cnsmrvrfy.com/content?id=3bfb5dce5e4f46c28c5f761796b3b57a Requested by Host: citizenmj.com URL: https://citizenmj.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.60.1.61 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software Kestrel / Resource Hash 3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers pragma no-cache date Mon, 03 Apr 2023 14:44:11 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Kestrel x-cdn Imperva content-type image/gif x-iinfo 1008-24919698-24699282 pNNy RT(1680533051341 22) q(0 0 0 1) r(2 2) U24 cache-control no-store,no-cache content-length 807
GET H2	200	form-loader.js Show response formrequests.com/installment36/1q_pd_im/	16 KB 7 KB	350ms 286ms	Script application/javascript	2606:4700:20::681a:1f7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://formrequests.com/installment36/1q_pd_im/form-loader.js Requested by Host: citizenmj.com URL: https://citizenmj.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:1f7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6b86338d179f0ef43f8f299b009992f69c94c838ce67bc643d399c46233f2b6f Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Mon, 03 Apr 2023 14:44:11 GMT content-encoding br cf-cache-status DYNAMIC last-modified Thu, 30 Mar 2023 09:56:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"64255cd9-4137" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C0qxMH%2FUIi1LnWsoOjm1KtBYECjONNvTa8HbxYA0Kq05aYFKXUH9AiIN17QCWHz75pnq%2BbDrAc6M2HRivcwHcfAtHZEBODtXz%2B1Ef4lEL5DQ5U2q5dppG0c9B%2BbPQS%2F2%2FpfeLI2qBYADfzdhTPI%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control no-cache, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, post-check=0, pre-check=0 cf-ray 7b22169169fc0b62-AMS expires Mon, 03 Apr 2023 14:44:10 GMT
GET H/1.1	200 OK	jquery-3.2.1.min.js Show response citizenmj.com/js/libs/	85 KB 85 KB	16ms 16ms	Script application/javascript	172.86.75.147 BLNWX
General Check archive.org Show headers Download Go to Full URL https://citizenmj.com/js/libs/jquery-3.2.1.min.js Requested by Host: citizenmj.com URL: https://citizenmj.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 172.86.75.147 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35 Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 14:44:11 GMT Last-Modified Mon, 27 Mar 2023 01:38:42 GMT Server nginx/1.20.1 ETag "6420f3a2-15287" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 86663
GET H2	200	hit.core.js Show response formrequests.com/	40 KB 16 KB	88ms 24ms	Script application/javascript	2606:4700:20::681a:1f7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://formrequests.com/hit.core.js Requested by Host: citizenmj.com URL: https://citizenmj.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:1f7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a45b2633461df917bf778e1b9899a2b39938da985fb793dbc58133307a22a42c Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Mon, 03 Apr 2023 14:44:11 GMT content-encoding br cf-cache-status HIT last-modified Thu, 30 Mar 2023 09:56:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6845 etag W/"64255cb2-9e13" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sf9cpZ4N8J9PlAYf3RhZyouiFbbXkeMKMmChGaVoX8PbxXVeyPCitP6X1ywMN5bgvMzkwBpN%2FRk4O9HTltm5URF6nXPvexDAdxEYfrsvpqNm9mKwYDg7w7UpgWdiSXewyKmLO2kNTmTQR%2BZgHYs%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 access-control-allow-origin * cf-ray 7b22169169f80b62-AMS
GET H/1.1	200 OK	general.js Show response citizenmj.com/js/	4 KB 5 KB	44ms 15ms	Script application/javascript	172.86.75.147 BLNWX
General Check archive.org Show headers Download Go to Full URL https://citizenmj.com/js/general.js Requested by Host: citizenmj.com URL: https://citizenmj.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 172.86.75.147 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 2503226a9da7f08839fdf519cbb136d56bec349e8a8ec1dee0678663ebf9ba7d Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 14:44:11 GMT Last-Modified Mon, 27 Mar 2023 01:38:42 GMT Server nginx/1.20.1 ETag "6420f3a2-11b1" Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 4529
GET H/1.1	200 OK	form_bg.jpg citizenmj.com/images/	158 KB 159 KB	28ms 28ms	Image image/jpeg	172.86.75.147 BLNWX
General Check archive.org Show headers Download Go to Show image Full URL https://citizenmj.com/images/form_bg.jpg Requested by Host: citizenmj.com URL: https://citizenmj.com/css/index.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 172.86.75.147 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 577ca142b451eef45da54350a227fcc59c3b6322fa3777adaba69ccc78b60b0a Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/css/index.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 14:44:11 GMT Last-Modified Mon, 27 Mar 2023 01:38:42 GMT Server nginx/1.20.1 ETag "6420f3a2-279ba" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 162234
GET H/1.1	200 OK	padlock.png citizenmj.com/images/	513 B 751 B	16ms 15ms	Image image/png	172.86.75.147 BLNWX
General Check archive.org Show headers Download Go to Show image Full URL https://citizenmj.com/images/padlock.png Requested by Host: citizenmj.com URL: https://citizenmj.com/css/index.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 172.86.75.147 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 2167b6461c0ce69f06d546340bf424d2e2a60877e8371e1a33df5dd31c026540 Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/css/index.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 14:44:11 GMT Last-Modified Mon, 27 Mar 2023 01:38:42 GMT Server nginx/1.20.1 ETag "6420f3a2-201" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 513
GET H/1.1	200 OK	clock.png citizenmj.com/images/	683 B 921 B	31ms 14ms	Image image/png	172.86.75.147 BLNWX
General Check archive.org Show headers Download Go to Show image Full URL https://citizenmj.com/images/clock.png Requested by Host: citizenmj.com URL: https://citizenmj.com/css/index.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 172.86.75.147 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 1cc29301672af596cd12a6e98cd07033a7ea2c9837461469413dab497711eb9a Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/css/index.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 14:44:11 GMT Last-Modified Mon, 27 Mar 2023 01:38:40 GMT Server nginx/1.20.1 ETag "6420f3a0-2ab" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 683
GET H/1.1	200 OK	laptop.png citizenmj.com/images/	407 B 645 B	41ms 14ms	Image image/png	172.86.75.147 BLNWX
General Check archive.org Show headers Download Go to Show image Full URL https://citizenmj.com/images/laptop.png Requested by Host: citizenmj.com URL: https://citizenmj.com/css/index.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 172.86.75.147 Amsterdam, Netherlands, ASN399629 (BLNWX, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 82ad104bf5655eccea66188a1dd453100cdad3bcc7aba0569061bdc316bd0f89 Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/css/index.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 14:44:11 GMT Last-Modified Mon, 27 Mar 2023 01:38:42 GMT Server nginx/1.20.1 ETag "6420f3a2-197" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 407
GET H2	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	68ms 20ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://citizenmj.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 28 Mar 2023 10:31:11 GMT x-content-type-options nosniff age 533580 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15744 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:48 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 27 Mar 2024 10:31:11 GMT
GET H2	200	KFOlCnqEu92Fr1MmWUlfBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	15 KB 16 KB	73ms 25ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://citizenmj.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 28 Mar 2023 10:31:10 GMT x-content-type-options nosniff age 533581 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15860 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:42 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 27 Mar 2024 10:31:10 GMT
GET H2	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v30/	16 KB 16 KB	89ms 41ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Roboto:300,400,500,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://citizenmj.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 28 Mar 2023 10:31:04 GMT x-content-type-options nosniff age 533587 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 15920 x-xss-protection 0 last-modified Wed, 11 May 2022 19:24:45 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 27 Mar 2024 10:31:04 GMT
GET		/ consumertransferservice.com/hit/	0 0
OPTIONS H2	403	/ consumertransferservice.com/hit/ Frame	0 0	495ms 112ms	Preflight text/html	2a02:e980::3d INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980::3d , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,mb-info-type Access-Control-Request-Method GET Origin https://citizenmj.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers cache-control no-cache, no-store content-length 848 content-type text/html x-iinfo 7-17152012-0 0NNN RT(1680533050878 113) q(0 -1 -1 0) r(0 -1) B16 U24
GET H/1.1	200 OK	calculate Show response thumb-service.com/	44 B 881 B	756ms 648ms	Fetch application/json	34.140.161.81 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://thumb-service.com/calculate?fp=b1435535f12f13f446376cf05dc6e4c4 Requested by Host: formrequests.com URL: https://formrequests.com/hit.core.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.140.161.81 Brussels, Belgium, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 81.161.140.34.bc.googleusercontent.com Software nginx / Resource Hash af54cabee9ed1d71065d5d83d58b098ad0887278ab6a757b8121ece3d443664d Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 14:44:12 GMT Content-Encoding gzip Server nginx X-CDN Imperva Transfer-Encoding chunked Vary Origin Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://citizenmj.com X-Iinfo 9-32270912-32270914 NNYN CT(142 290 0) RT(1680533051011 6) q(0 0 4 -1) r(6 6) U24 Access-Control-Allow-Credentials true Connection keep-alive
GET H2	200	ccpa-app.js Show response formrequests.com/ccpa/	76 KB 15 KB	23ms 22ms	Script application/javascript	2606:4700:20::681a:1f7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://formrequests.com/ccpa/ccpa-app.js Requested by Host: formrequests.com URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:1f7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3d27dd41afda0eabf5f9cae37a9d2dfac36f7dcc6650981a03bda4c3ac9c83df Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Mon, 03 Apr 2023 14:44:11 GMT content-encoding br cf-cache-status HIT last-modified Thu, 30 Mar 2023 09:56:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 3255 etag W/"64255cb2-13082" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YJ9q5DIP%2FMoab3KrwfLD0cDhQTmxByF4pKtIrjMabq6m%2BaaFaPvEz4I1ItedyjllrhUGywt2Ijf3bj7w9BZSlooJyLHHLuwCG5DEwOBjAJC3bXznpVm1qZy%2BaWF33MPQ%2BWrAQgbHdxL9HmUFnoE%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 access-control-allow-origin * cf-ray 7b2216933ca40b62-AMS
GET H2	200	1ea1d51a-3e9b-d9e5-164a-f6e3f7fc55f5.js Show response create.lidstatic.com/campaign/	121 KB 38 KB	462ms 421ms	Script text/javascript	2606:4700:10::ac43:29e5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://create.lidstatic.com/campaign/1ea1d51a-3e9b-d9e5-164a-f6e3f7fc55f5.js?snippet_version=2&callback=getlidtoken Requested by Host: formrequests.com URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:29e5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 227b26ea5b1555224274a616dd96e5b3875321fe3cef0b0a61675ed39909cbbb Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Mon, 03 Apr 2023 14:44:11 GMT x-amz-version-id vtj75R_MuxtdN1otH0atybe8FUgx5e3D content-encoding gzip cf-cache-status REVALIDATED last-modified Mon, 24 Oct 2022 11:04:26 GMT server cloudflare x-amz-request-id 0VSHVXGGCK9FYZYZ etag W/"bb3e4ba47212815dd0d930250c853160" x-amz-server-side-encryption AES256 vary Accept-Encoding content-type text/javascript cache-control max-age=1800 x-amz-replication-status COMPLETED cf-ray 7b2216937cf60a4f-AMS x-amz-id-2 6Og9PlauTW1CJ40+y6eL103dfjJhM9Uo9/7CoVRtApPzTMAwwy32nRD/eqNJSKjLGBscMeJLIkI=
GET H2	200	ccpa-app.css formrequests.com/ccpa/	15 KB 3 KB	22ms 22ms	Stylesheet text/css	2606:4700:20::681a:1f7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://formrequests.com/ccpa/ccpa-app.css Requested by Host: formrequests.com URL: https://formrequests.com/ccpa/ccpa-app.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:1f7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1e9193832ce79eae43af3afd8579b3f6139382c02b3a70e4431df137210d3b5 Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Mon, 03 Apr 2023 14:44:11 GMT content-encoding br cf-cache-status HIT last-modified Thu, 30 Mar 2023 09:56:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1228 etag W/"64255cb2-3bde" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=isQKXDsQHS8Cs0Y75yRlGuXfq0jW%2BhAmAs%2Bghzyc5fdo8y5mXKLqholzuVDlhQV2uPPskim8N4rZw0EgtoBlVnzJypH4WguKkfAQqWihQn8Nn4%2B7AWkHZsNlAbGZQLHbvaUUgbyg44VFti8dVYg%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cf-ray 7b2216936cd30b62-AMS
GET H2	200	css fonts.googleapis.com/	6 KB 755 B	30ms 29ms	Stylesheet text/css	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Roboto:400,500,700&display=swap Requested by Host: formrequests.com URL: https://formrequests.com/ccpa/ccpa-app.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 931d2a6a0b4b62f6c408c4d69166f12f9be5894f45fceb005402b86f9fa9cb26 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://formrequests.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Mon, 03 Apr 2023 14:44:11 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 03 Apr 2023 14:15:51 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 03 Apr 2023 14:44:11 GMT
POST H2	200	GenerateToken Show response create.leadid.com/2.11.13/	36 B 660 B	378ms 153ms	XHR text/plain	54.198.13.191 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://create.leadid.com/2.11.13/GenerateToken?msn=1&pid=e7119b15-7eb0-455b-b676-39159e2cc001&_=441504295 Requested by Host: create.lidstatic.com URL: https://create.lidstatic.com/campaign/1ea1d51a-3e9b-d9e5-164a-f6e3f7fc55f5.js?snippet_version=2&callback=getlidtoken Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.198.13.191 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-198-13-191.compute-1.amazonaws.com Software nginx / Resource Hash cf62b8ae3e4767d7a2e9d538c3cf050eb563417c24f95eb287a6565dc61e3c29 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://citizenmj.com/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Mon, 03 Apr 2023 14:44:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip server nginx access-control-max-age 1728000 content-type text/plain;charset=UTF-8 access-control-allow-origin * cache-control no-cache, must-revalidate access-control-allow-headers X-Requested-With, Content-Type expires Sat, 26 Jul 1997 05:00:00 GMT
GET H/1.1	200 OK	iframe.html Show response d2m2wsoho8qq12.cloudfront.net/ Frame 83FD	3 KB 2 KB	74ms 21ms	Document text/html	13.32.118.96 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=48ECFA2B-360E-91AC-FCA0-2C64625A7081&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.13&lck=1EA1D51A-3E9B-D9E5-164A-F6E3F7FC55F5&lac=90A8CAE6-CC73-70E5-0C13-585FC92E8C5A Requested by Host: create.lidstatic.com URL: https://create.lidstatic.com/campaign/1ea1d51a-3e9b-d9e5-164a-f6e3f7fc55f5.js?snippet_version=2&callback=getlidtoken Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 13.32.118.96 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-118-96.fra60.r.cloudfront.net Software nginx / Resource Hash e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://citizenmj.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers Age 28710 Connection keep-alive Content-Encoding gzip Content-Type text/html Date Mon, 03 Apr 2023 06:45:42 GMT ETag W/"641b3057-dbb" Last-Modified Wed, 22 Mar 2023 16:44:07 GMT Server nginx Strict-Transport-Security max-age=31536000; includeSubDomains; preload Transfer-Encoding chunked Via 1.1 6fd3ab2be93b19c970fb371964d46d94.cloudfront.net (CloudFront) X-Amz-Cf-Id GRZdX0kCzqN2-yJPRH4lDwwdCNHukCY0AytUpk6bbDIjf3WXjQRadg== X-Amz-Cf-Pop FRA60-P1 X-Cache Hit from cloudfront
POST H2	200	SaveDom Show response create.leadid.com/2.11.13/	0 623 B	105ms 104ms	XHR text/plain	54.198.13.191 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://create.leadid.com/2.11.13/SaveDom?msn=2&pid=e7119b15-7eb0-455b-b676-39159e2cc001&token=48ECFA2B-360E-91AC-FCA0-2C64625A7081&_=441504296 Requested by Host: create.lidstatic.com URL: https://create.lidstatic.com/campaign/1ea1d51a-3e9b-d9e5-164a-f6e3f7fc55f5.js?snippet_version=2&callback=getlidtoken Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.198.13.191 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-198-13-191.compute-1.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://citizenmj.com/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Mon, 03 Apr 2023 14:44:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip server nginx access-control-max-age 1728000 content-type text/plain;charset=UTF-8 access-control-allow-origin * cache-control no-cache, must-revalidate access-control-allow-headers X-Requested-With, Content-Type expires Sat, 26 Jul 1997 05:00:00 GMT
GET H2	200	iframe.html Show response deviceid.trueleadid.com/ Frame F1DB	4 KB 2 KB	355ms 95ms	Document text/html	35.169.79.47 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://deviceid.trueleadid.com/iframe.html?token=48ECFA2B-360E-91AC-FCA0-2C64625A7081&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.13&lck=1EA1D51A-3E9B-D9E5-164A-F6E3F7FC55F5&lac=90A8CAE6-CC73-70E5-0C13-585FC92E8C5A Requested by Host: d2m2wsoho8qq12.cloudfront.net URL: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=48ECFA2B-360E-91AC-FCA0-2C64625A7081&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.13&lck=1EA1D51A-3E9B-D9E5-164A-F6E3F7FC55F5&lac=90A8CAE6-CC73-70E5-0C13-585FC92E8C5A Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.169.79.47 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-169-79-47.compute-1.amazonaws.com Software nginx / Resource Hash 602ea48b7fd2a48e702e43825b0d6f6495f78cb4cc1fa24cb8c95f61e014215a Request headers Referer https://d2m2wsoho8qq12.cloudfront.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers cache-control max-age=86400 public content-encoding gzip content-type text/html date Mon, 03 Apr 2023 14:44:12 GMT etag W/"6425e809-1049" expires Tue, 04 Apr 2023 14:44:12 GMT last-modified Thu, 30 Mar 2023 19:50:33 GMT p3p CP="NOI DSP COR NID CUR ADM DEV OUR BUS" server nginx
GET		/ consumertransferservice.com/hit/	0 0
OPTIONS H2	403	/ consumertransferservice.com/hit/ Frame	0 0	175ms 174ms	Preflight text/html	2a02:e980::3d INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980::3d , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,mb-info-type Access-Control-Request-Method GET Origin https://citizenmj.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers cache-control no-cache, no-store content-length 854 content-type text/html x-iinfo 16-135231080-0 0NNN RT(1680533050967 1200) q(0 -1 -1 18) r(0 -1) B16 U24
GET H2	200	SaveDeviceId.js Show response create.leadid.com/2.11.13/ Frame F1DB	0 628 B	314ms 108ms	Script text/javascript	54.198.13.191 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://create.leadid.com/2.11.13/SaveDeviceId.js?lac=90A8CAE6-CC73-70E5-0C13-585FC92E8C5A&lck=1EA1D51A-3E9B-D9E5-164A-F6E3F7FC55F5&methods=48&token=48ECFA2B-360E-91AC-FCA0-2C64625A7081&uuid=dfc6fec4538d4709aa2636f00e73691e Requested by Host: deviceid.trueleadid.com URL: https://deviceid.trueleadid.com/iframe.html?token=48ECFA2B-360E-91AC-FCA0-2C64625A7081&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.11.13&lck=1EA1D51A-3E9B-D9E5-164A-F6E3F7FC55F5&lac=90A8CAE6-CC73-70E5-0C13-585FC92E8C5A Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.198.13.191 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-198-13-191.compute-1.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language nl-NL,nl;q=0.9 Referer https://deviceid.trueleadid.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Mon, 03 Apr 2023 14:44:12 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip server nginx access-control-max-age 1728000 content-type text/javascript;charset=UTF-8 access-control-allow-origin * cache-control no-cache, must-revalidate access-control-allow-headers X-Requested-With, Content-Type expires Sat, 26 Jul 1997 05:00:00 GMT
POST H2	200	Snap Show response create.leadid.com/2.11.13/	0 623 B	408ms 207ms	XHR text/plain	54.198.13.191 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://create.leadid.com/2.11.13/Snap?msn=3&pid=e7119b15-7eb0-455b-b676-39159e2cc001&token=48ECFA2B-360E-91AC-FCA0-2C64625A7081&_=441504297 Requested by Host: create.lidstatic.com URL: https://create.lidstatic.com/campaign/1ea1d51a-3e9b-d9e5-164a-f6e3f7fc55f5.js?snippet_version=2&callback=getlidtoken Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.198.13.191 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-198-13-191.compute-1.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://citizenmj.com/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Mon, 03 Apr 2023 14:44:13 GMT strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip server nginx access-control-max-age 1728000 content-type text/plain;charset=UTF-8 access-control-allow-origin * cache-control no-cache, must-revalidate access-control-allow-headers X-Requested-With, Content-Type expires Sat, 26 Jul 1997 05:00:00 GMT
GET		/ consumertransferservice.com/hit/	0 0
OPTIONS H2	403	/ consumertransferservice.com/hit/ Frame	0 0	458ms 132ms	Preflight text/html	2a02:e980::3d INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980::3d , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,mb-info-type Access-Control-Request-Method GET Origin https://citizenmj.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers cache-control no-cache, no-store content-length 852 content-type text/html x-iinfo 18-168516381-0 0NNN RT(1680533053519 129) q(0 -1 -1 2) r(0 -1) B16 U24
POST H2	201	log Show response cnsmrvrfy.com/	0 424 B	178ms 178ms	XHR text/plain	2a02:e980::3d INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://cnsmrvrfy.com/log Requested by Host: formrequests.com URL: https://formrequests.com/hit.core.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980::3d , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software Kestrel / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://citizenmj.com/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Content-Type application/json Response headers date Mon, 03 Apr 2023 14:44:15 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Kestrel x-cdn Imperva vary Origin access-control-allow-origin https://citizenmj.com x-iinfo 18-168516600-168131824 pNNN RT(1680533054879 576) q(0 0 0 4) r(1 1) U24 access-control-allow-credentials true content-length 0
OPTIONS H2	204	log cnsmrvrfy.com/ Frame	0 0	692ms 177ms	Preflight	2a02:e980::3d INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://cnsmrvrfy.com/log Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980::3d , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software Kestrel / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://citizenmj.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type access-control-allow-methods POST access-control-allow-origin https://citizenmj.com date Mon, 03 Apr 2023 14:44:15 GMT server Kestrel strict-transport-security max-age=31536000; includeSubDomains; preload vary Origin x-cdn Imperva x-iinfo 18-168516600-168131824 pNNN RT(1680533054879 399) q(0 0 0 0) r(1 1) U24
GET H2	200	GetSplitTestForm Show response cnsmrvrfy.com/misc/	17 B 529 B	179ms 178ms	Fetch application/json	2a02:e980::3d INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://cnsmrvrfy.com/misc/GetSplitTestForm?campId=270122&mainForm=1q_pd_im Requested by Host: formrequests.com URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980::3d , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software Kestrel / Resource Hash 31b9cb64398010da86662a07ec0bca33495683a1f3bd9422bd1256258edca296 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Mon, 03 Apr 2023 14:44:16 GMT strict-transport-security max-age=31536000; includeSubDomains; preload server Kestrel x-cdn Imperva vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://citizenmj.com x-iinfo 18-168516600-168131824 pNNN RT(1680533054879 1086) q(0 0 0 -1) r(1 1) U24 access-control-expose-headers timestamp,date access-control-allow-credentials true content-length 17
GET H2	200	theme.css formrequests.com/installment36/1q_pd_im/	65 KB 17 KB	25ms 24ms	Stylesheet text/css	2606:4700:20::681a:1f7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://formrequests.com/installment36/1q_pd_im/theme.css Requested by Host: formrequests.com URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:1f7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b7b2234070b4741c351760fb27a2c8b7f1828c6382bb8ebe86f9b1a46d94cb62 Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Mon, 03 Apr 2023 14:44:16 GMT content-encoding br cf-cache-status HIT last-modified Thu, 30 Mar 2023 09:56:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6847 etag W/"64255cb2-10376" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nq%2FjB8hNmDlNv4UFjDo6O61N%2BCbAaOeUK9IY0%2FW5jN3mTVr5dhKSdBh8FUig06zLpYPVytHPmLYJAve%2B%2FpjKv4jeLJrzKga51jq95bDmMNbY%2FB36JxV4hV8CQVGi%2BjbVlz4ueSPuP3Da2QY2m8A%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cf-ray 7b2216b43d400b62-AMS
GET		app.js formrequests.com/installment36/1q_pd_im/	0 0
GET H2	200	async.css formrequests.com/installment36/1q_pd_im/	14 KB 9 KB	23ms 23ms	Stylesheet text/css	2606:4700:20::681a:1f7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://formrequests.com/installment36/1q_pd_im/async.css Requested by Host: formrequests.com URL: https://formrequests.com/installment36/1q_pd_im/form-loader.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:1f7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7270c2feff9be5d497127bbee70f909153b7bc15d72745ea36df46b9f26b0941 Request headers accept-language nl-NL,nl;q=0.9 Referer https://citizenmj.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Mon, 03 Apr 2023 14:44:16 GMT content-encoding br cf-cache-status HIT last-modified Thu, 30 Mar 2023 09:56:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6847 etag W/"64255cb2-363a" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gvf17Ep9NKmOiV467RDdgWdXhJu%2FNgHQz4o0oKG1JFCk3kxECcIJaSnKoR41UXft5%2BtXrLjP4ce3PifUFXoER4ydR6uuNslRByN97NiWdLTRpMfh%2F%2FkOuoV%2FahCSRC7HLtN6HoNZZLCp%2F%2FY%2FRlk%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cf-ray 7b2216b43d410b62-AMS
GET H3	200	css fonts.googleapis.com/	3 KB 546 B	30ms 29ms	Stylesheet text/css	2a00:1450:4001:828::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Montserrat:400,700 Requested by Host: formrequests.com URL: https://formrequests.com/installment36/1q_pd_im/theme.css Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash db0e93a6caa38aa56a60492fbb22c1d09e743b879bf3486c2caf5e6dc290cf32 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://formrequests.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Mon, 03 Apr 2023 14:44:16 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 03 Apr 2023 14:21:34 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 03 Apr 2023 14:44:16 GMT
GET H2	200	JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 fonts.gstatic.com/s/montserrat/v25/	30 KB 30 KB	21ms 20ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/montserrat/v25/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Montserrat:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://citizenmj.com accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Tue, 28 Mar 2023 10:32:46 GMT x-content-type-options nosniff age 533490 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30928 x-xss-protection 0 last-modified Mon, 11 Jul 2022 18:57:39 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 27 Mar 2024 10:32:46 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

consumertransferservice.com

URL

https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122

Domain

consumertransferservice.com

URL

https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122

Domain

consumertransferservice.com

URL

https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122

Domain

formrequests.com

URL

https://formrequests.com/installment36/1q_pd_im/app.js?v=100133122

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| lmpost function| $ function| jQuery object| __jsf__Cnsmrvrfy function| hitregistersuccess boolean| hitcorejsalreadyfired boolean| __jsf__initFp boolean| __Zone_disable_IE_check object| __jsf__ number| timeJSForms function| getlidtoken object| dataLayer boolean| __ccpa_init__ object| __ccpa__ object| LeadiDconfig object| LeadiD string| __jsf__jornayaUid object| defaultStyleFrame

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			citizenmj.com/	1969-12-31 23:59:59	Name: lm_campid Value: 270122
			.cnsmrvrfy.com/	1969-12-31 23:59:59	Name: nlbi_2118974 Value: zyOFRitrPk1vRgrxqnjY6wAAAABO3vOg2I2nGfVqXIMZ366G
			.cnsmrvrfy.com/	1970-01-20 19:33:29	Name: visid_incap_2118974 Value: 5MZWC7v3QgGDXLaTBTuNozvmKmQAAAAAQUIPAAAAAAAnoldShv1l51fKDdVYrxpl
			.cnsmrvrfy.com/	1969-12-31 23:59:59	Name: incap_ses_768_2118974 Value: KGfmFljQ0wP7S+M0NHyoCjvmKmQAAAAAJurmEqZTNwuiaU8ng30Stw==
			citizenmj.com/	1969-12-31 23:59:59	Name: leadid_token-90A8CAE6-CC73-70E5-0C13-585FC92E8C5A-1EA1D51A-3E9B-D9E5-164A-F6E3F7FC55F5 Value: 48ECFA2B-360E-91AC-FCA0-2C64625A7081
			.deviceid.trueleadid.com/	1970-01-20 20:24:53	Name: uuid Value: dfc6fec4538d4709aa2636f00e73691e

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://citizenmj.com/ Message: Access to XMLHttpRequest at 'https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122' from origin 'https://citizenmj.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://citizenmj.com/ Message: Access to XMLHttpRequest at 'https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122' from origin 'https://citizenmj.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://citizenmj.com/ Message: Access to XMLHttpRequest at 'https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122' from origin 'https://citizenmj.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://consumertransferservice.com/hit/?clienturl=https%3A//citizenmj.com/&rnd=0.5685680139680747&responsetype=json&o=0&ReferrerURL=&c=270122 Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.cnsmrvrfy.com
citizenmj.com
cnsmrvrfy.com
consumertransferservice.com
create.leadid.com
create.lidstatic.com
d2m2wsoho8qq12.cloudfront.net
deviceid.trueleadid.com
fonts.googleapis.com
fonts.gstatic.com
formrequests.com
thumb-service.com
consumertransferservice.com
formrequests.com
13.32.118.96
172.86.75.147
2606:4700:10::ac43:29e5
2606:4700:20::681a:1f7
2a00:1450:4001:812::2003
2a00:1450:4001:828::200a
2a02:e980::3d
34.140.161.81
35.169.79.47
45.60.1.61
54.198.13.191
1cc29301672af596cd12a6e98cd07033a7ea2c9837461469413dab497711eb9a
2167b6461c0ce69f06d546340bf424d2e2a60877e8371e1a33df5dd31c026540
227b26ea5b1555224274a616dd96e5b3875321fe3cef0b0a61675ed39909cbbb
2503226a9da7f08839fdf519cbb136d56bec349e8a8ec1dee0678663ebf9ba7d
31b9cb64398010da86662a07ec0bca33495683a1f3bd9422bd1256258edca296
3ca19e57c9a2465ae4df271316ba4d29e7ff7f113a2a2c5297780c0b7a0ac09d
3d27dd41afda0eabf5f9cae37a9d2dfac36f7dcc6650981a03bda4c3ac9c83df
577ca142b451eef45da54350a227fcc59c3b6322fa3777adaba69ccc78b60b0a
602ea48b7fd2a48e702e43825b0d6f6495f78cb4cc1fa24cb8c95f61e014215a
6b86338d179f0ef43f8f299b009992f69c94c838ce67bc643d399c46233f2b6f
7270c2feff9be5d497127bbee70f909153b7bc15d72745ea36df46b9f26b0941
75b707d8761e2bfbd25fbd661f290a4f7fd11c48e1bf53a36dc6bd8a0034fa35
82ad104bf5655eccea66188a1dd453100cdad3bcc7aba0569061bdc316bd0f89
8cb00b3db2e68ae430cd96730d426b74a42cd138f3f2475564861aa1fdda0888
931d2a6a0b4b62f6c408c4d69166f12f9be5894f45fceb005402b86f9fa9cb26
a45b2633461df917bf778e1b9899a2b39938da985fb793dbc58133307a22a42c
ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
af54cabee9ed1d71065d5d83d58b098ad0887278ab6a757b8121ece3d443664d
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b7b2234070b4741c351760fb27a2c8b7f1828c6382bb8ebe86f9b1a46d94cb62
cf62b8ae3e4767d7a2e9d538c3cf050eb563417c24f95eb287a6565dc61e3c29
d1e9193832ce79eae43af3afd8579b3f6139382c02b3a70e4431df137210d3b5
db0822715644c1bdeae42bf2525e49ce3e35ae2335c9bdd9a534ed706885e4c8
db0e93a6caa38aa56a60492fbb22c1d09e743b879bf3486c2caf5e6dc290cf32
e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
fc8cec1406d4fb7fdb48e0c4897503b653db7d835c60dc1f61d5b8c86666b0bc