employeetaxrefund.com Open in urlscan Pro
2606:4700:3036::6815:294 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://employeetaxrefund.com/
Submission: On April 25 via manual (April 25th 2022, 2:47:28 pm UTC) from US — Scanned from DE

Summary HTTP 147 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 62 IPs in 9 countries across 56 domains to perform 147 HTTP transactions. The main IP is 2606:4700:3036::6815:294, located in United States and belongs to CLOUDFLARENET, US. The main domain is employeetaxrefund.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 15th 2021. Valid for: a year.

This is the only time employeetaxrefund.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3036::6815:294	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1 16	2a06:98c1:312... 2a06:98c1:3120::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:1734	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2a06:98c1:312... 2a06:98c1:3121::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	162.159.128.61 162.159.128.61	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:9000:231... 2600:9000:2315:5400:b:d801:7900:93a1	16509 (AMAZON-02) (AMAZON-02)
17	2606:4700::68... 2606:4700::6812:15b4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
7	54.157.91.127 54.157.91.127	14618 (AMAZON-AES) (AMAZON-AES)
2	151.101.114.109 151.101.114.109	54113 (FASTLY) (FASTLY)
2	151.101.14.109 151.101.14.109	54113 (FASTLY) (FASTLY)
4	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	84.17.46.53 84.17.46.53	60068 (CDN77 ^_^) (CDN77 ^_^)
2	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
1	2a0b:4d07:102::1 2a0b:4d07:102::1	44239 (PROINITY ...) (PROINITY PROINITY)
2	2a00:1450:400... 2a00:1450:4001:801::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
3	54.216.252.255 54.216.252.255	16509 (AMAZON-02) (AMAZON-02)
1	34.232.251.165 34.232.251.165	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:9000:206... 2600:9000:206f:7800:6:36e8:9f00:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
1	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
3	2a00:1288:80:... 2a00:1288:80:807::2	203220 (YAHOO-DEB) (YAHOO-DEB)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	18.210.240.141 18.210.240.141	14618 (AMAZON-AES) (AMAZON-AES)
3 4	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
3	52.167.85.21 52.167.85.21	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	178.250.2.146 178.250.2.146	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
2	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
1 5	178.250.2.151 178.250.2.151	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	74.119.119.150 74.119.119.150	19750 (AS-CRITEO) (AS-CRITEO)
3	108.157.4.72 108.157.4.72	16509 (AMAZON-02) (AMAZON-02)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 1	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
1	54.73.16.64 54.73.16.64	16509 (AMAZON-02) (AMAZON-02)
1	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1	70.42.32.95 70.42.32.95	13789 (INTERNAP-...) (INTERNAP-BLK3)
1	184.30.24.121 184.30.24.121	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
3 4	37.252.172.249 37.252.172.249	29990 (ASN-APPNEX) (ASN-APPNEX)
3 3	37.252.173.215 37.252.173.215	29990 (ASN-APPNEX) (ASN-APPNEX)
1	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
1	104.90.192.189 104.90.192.189	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2.20.85.164 2.20.85.164	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:205... 2600:9000:2057:aa00:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1 2	3.121.19.101 3.121.19.101	16509 (AMAZON-02) (AMAZON-02)
1	104.111.242.245 104.111.242.245	16625 (AKAMAI-AS) (AKAMAI-AS)
1	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1	185.86.137.133 185.86.137.133	201081 (SMARTADSE...) (SMARTADSERVER)
1	3.120.83.85 3.120.83.85	16509 (AMAZON-02) (AMAZON-02)
1 2	34.248.117.172 34.248.117.172	16509 (AMAZON-02) (AMAZON-02)
2 2	35.153.58.122 35.153.58.122	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:1f18:444... 2600:1f18:444a:4680:27f9:539b:c9b0:d2ce	14618 (AMAZON-AES) (AMAZON-AES)
1	54.227.185.17 54.227.185.17	14618 (AMAZON-AES) (AMAZON-AES)
1	2600:1f18:612... 2600:1f18:612b:4216:25d9:1223:9f5d:e330	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2.18.234.233 2.18.234.233	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1b	20446 (STACKPATH...) (STACKPATH-CDN)
1	3.124.27.94 3.124.27.94	16509 (AMAZON-02) (AMAZON-02)
1 1	2001:678:cb4:... 2001:678:cb4:bbbb::13	56396 (AMOBEE) (AMOBEE)
147	62

2 2606:4700:3036::6815:294 (United States)

ASN13335 (CLOUDFLARENET, US)

employeetaxrefund.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a06:98c1:3120::7 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

app.groove.cm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.groovefunnels.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a06:98c1:3121::7 (United States)

ASN13335 (CLOUDFLARENET, US)

matomo.groovetech.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.gdapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.159.128.61 (None, )

ASN13335 (CLOUDFLARENET, US)

player.vimeo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2315:5400:b:d801:7900:93a1 (United States)

ASN16509 (AMAZON-02, US)

widget.groovevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
videos.groovevideo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2606:4700::6812:15b4 (United States)

ASN13335 (CLOUDFLARENET, US)

assets.grooveapps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 54.157.91.127 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-91-127.compute-1.amazonaws.com

fs22.formsite.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.114.109 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.vimeocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.109 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

f.vimeocdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 84.17.46.53 (Amsterdam, Netherlands)

ASN60068 (CDN77 ^_^, GB)
PTR: unn-84-17-46-53.cdn77.com

cdn.productstash.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0b:4d07:102::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

cdn.tooltip.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.216.252.255 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-216-252-255.eu-west-1.compute.amazonaws.com

api.loopedin.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.232.251.165 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-232-251-165.compute-1.amazonaws.com

pp.signalayer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:7800:6:36e8:9f00:93a1 (United States)

ASN16509 (AMAZON-02, US)

data.tooltip.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:80:807::2 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.210.240.141 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-210-240-141.compute-1.amazonaws.com

175592.tracking.hyros.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:2638::1c (France) 3 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.167.85.21 (Boydton, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

i.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.2.146 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 178.250.2.151 (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

sslwidget.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)

widget.us.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 108.157.4.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-72.dus51.r.cloudfront.net

beacon-v2.helpscout.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.73.16.64 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-73-16-64.eu-west-1.compute.amazonaws.com

partner.mediawallahscript.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.126.56.137 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.42.32.95 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.24.121 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-24-121.deploy.static.akamaitechnologies.com

cw.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.252.172.249 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.173.215 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.245.213 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.90.192.189 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-90-192-189.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.20.85.164 (Milan, Italy) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-20-85-164.deploy.static.akamaitechnologies.com

r.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:aa00:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.121.19.101 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-19-101.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.242.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-242-245.deploy.static.akamaitechnologies.com

criteo-sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync-t1.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.137.133 (France)

ASN201081 (SMARTADSERVER, FR)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.120.83.85 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-83-85.eu-central-1.compute.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.248.117.172 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-117-172.eu-west-1.compute.amazonaws.com

ad.360yield.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.153.58.122 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-153-58-122.compute-1.amazonaws.com

i.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:444a:4680:27f9:539b:c9b0:d2ce (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

i6.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.227.185.17 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-227-185-17.compute-1.amazonaws.com

jadserve.postrelease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4216:25d9:1223:9f5d:e330 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

criteo-partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.233 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-233.deploy.static.akamaitechnologies.com

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

cdn.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.27.94 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-27-94.eu-central-1.compute.amazonaws.com

exchange.mediavine.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::13 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

d.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	grooveapps.com assets.grooveapps.com — Cisco Umbrella Rank: 309048	1 MB
11	criteo.com 4 redirects gum.criteo.com — Cisco Umbrella Rank: 381 mug.criteo.com — Cisco Umbrella Rank: 3086 sslwidget.criteo.com — Cisco Umbrella Rank: 1701 widget.us.criteo.com — Cisco Umbrella Rank: 18982 dis.criteo.com — Cisco Umbrella Rank: 741	17 KB
11	gstatic.com fonts.gstatic.com	223 KB
10	groove.cm app.groove.cm — Cisco Umbrella Rank: 343118	3 MB
7	adnxs.com 6 redirects secure.adnxs.com — Cisco Umbrella Rank: 394 ib.adnxs.com — Cisco Umbrella Rank: 226	7 KB
7	formsite.com fs22.formsite.com — Cisco Umbrella Rank: 451726	28 KB
7	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 39 ajax.googleapis.com — Cisco Umbrella Rank: 271	573 KB
6	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1575 ka-f.fontawesome.com — Cisco Umbrella Rank: 2865	114 KB
5	clarity.ms 1 redirects i.clarity.ms — Cisco Umbrella Rank: 1918 c.clarity.ms — Cisco Umbrella Rank: 626	24 KB
5	groovetech.io matomo.groovetech.io — Cisco Umbrella Rank: 389316	44 KB
4	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 823 ads.yahoo.com — Cisco Umbrella Rank: 1083 ups.analytics.yahoo.com — Cisco Umbrella Rank: 283	1 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 346 c.bing.com — Cisco Umbrella Rank: 209	13 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 212	126 KB
4	vimeocdn.com i.vimeocdn.com — Cisco Umbrella Rank: 2742 f.vimeocdn.com — Cisco Umbrella Rank: 2846	226 KB
3	liadm.com 2 redirects i.liadm.com — Cisco Umbrella Rank: 519 i6.liadm.com — Cisco Umbrella Rank: 1604	1 KB
3	helpscout.net beacon-v2.helpscout.net — Cisco Umbrella Rank: 10162	264 KB
3	loopedin.io api.loopedin.io — Cisco Umbrella Rank: 636188	3 KB
3	gdapis.com v1.gdapis.com	2 KB
2	stickyadstv.com 1 redirects ads.stickyadstv.com — Cisco Umbrella Rank: 623 cdn.stickyadstv.com — Cisco Umbrella Rank: 2236	1 KB
2	360yield.com 1 redirects ad.360yield.com — Cisco Umbrella Rank: 651	852 B
2	bidswitch.net 1 redirects x.bidswitch.net — Cisco Umbrella Rank: 274	1 KB
2	casalemedia.com 1 redirects r.casalemedia.com — Cisco Umbrella Rank: 2094	2 KB
2	3lift.com 1 redirects eb2.3lift.com — Cisco Umbrella Rank: 341	738 B
2	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 294	625 B
2	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 38 cm.g.doubleclick.net — Cisco Umbrella Rank: 195	2 KB
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 404	7 KB
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 94	51 KB
2	tooltip.io cdn.tooltip.io — Cisco Umbrella Rank: 168463 data.tooltip.io — Cisco Umbrella Rank: 190756	81 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 58	139 KB
2	productstash.io cdn.productstash.io — Cisco Umbrella Rank: 711644	8 KB
2	groovevideo.com widget.groovevideo.com videos.groovevideo.com	3 MB
2	vimeo.com player.vimeo.com — Cisco Umbrella Rank: 1676	10 KB
2	employeetaxrefund.com employeetaxrefund.com	51 KB
1	turn.com 1 redirects d.turn.com — Cisco Umbrella Rank: 748	418 B
1	mediavine.com exchange.mediavine.com — Cisco Umbrella Rank: 2563	40 B
1	tremorhub.com criteo-partners.tremorhub.com — Cisco Umbrella Rank: 2144	183 B
1	postrelease.com jadserve.postrelease.com — Cisco Umbrella Rank: 1164	428 B
1	sharethrough.com match.sharethrough.com — Cisco Umbrella Rank: 587	263 B
1	smartadserver.com rtb-csync.smartadserver.com — Cisco Umbrella Rank: 595	163 B
1	taboola.com sync-t1.taboola.com — Cisco Umbrella Rank: 1274	99 B
1	teads.tv criteo-sync.teads.tv — Cisco Umbrella Rank: 1823	172 B
1	smaato.net s.ad.smaato.net — Cisco Umbrella Rank: 720	239 B
1	media.net contextual.media.net — Cisco Umbrella Rank: 496	786 B
1	pubmatic.com simage2.pubmatic.com — Cisco Umbrella Rank: 584	681 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 318	239 B
1	addthis.com cw.addthis.com — Cisco Umbrella Rank: 1363	427 B
1	outbrain.com sync.outbrain.com — Cisco Umbrella Rank: 788	476 B
1	mediawallahscript.com partner.mediawallahscript.com — Cisco Umbrella Rank: 2105	232 B
1	google.de www.google.de — Cisco Umbrella Rank: 6544	548 B
1	google.com www.google.com — Cisco Umbrella Rank: 2	548 B
1	hyros.com 175592.tracking.hyros.com	170 B
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 628	13 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 103	15 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 35	20 KB
1	signalayer.com pp.signalayer.com — Cisco Umbrella Rank: 72958	260 B
1	groovefunnels.com 1 redirects app.groovefunnels.com	637 B
147	56

	Domain	Requested by
17	assets.grooveapps.com	employeetaxrefund.com
11	fonts.gstatic.com	fonts.googleapis.com fs22.formsite.com
10	app.groove.cm	employeetaxrefund.com widget.groovevideo.com app.groove.cm
7	fs22.formsite.com	employeetaxrefund.com fs22.formsite.com
5	matomo.groovetech.io	employeetaxrefund.com matomo.groovetech.io app.groove.cm
5	ka-f.fontawesome.com	kit.fontawesome.com employeetaxrefund.com
4	secure.adnxs.com	3 redirects employeetaxrefund.com
4	dis.criteo.com	employeetaxrefund.com
4	gum.criteo.com	3 redirects static.criteo.net
4	cdnjs.cloudflare.com	app.groove.cm
4	fonts.googleapis.com	employeetaxrefund.com app.groove.cm
3	ib.adnxs.com	3 redirects
3	beacon-v2.helpscout.net	app.groove.cm beacon-v2.helpscout.net
3	i.clarity.ms	bat.bing.com i.clarity.ms
3	bat.bing.com	employeetaxrefund.com bat.bing.com app.groove.cm
3	api.loopedin.io	cdn.productstash.io
3	ajax.googleapis.com	fs22.formsite.com
3	v1.gdapis.com	widget.groovevideo.com app.groove.cm
2	i.liadm.com	2 redirects
2	ad.360yield.com	1 redirects
2	x.bidswitch.net	1 redirects
2	r.casalemedia.com	1 redirects
2	eb2.3lift.com	1 redirects
2	idsync.rlcdn.com	employeetaxrefund.com
2	c.clarity.ms	1 redirects employeetaxrefund.com
2	sp.analytics.yahoo.com	app.groove.cm employeetaxrefund.com
2	s.yimg.com	employeetaxrefund.com s.yimg.com
2	www.youtube.com	app.groove.cm www.youtube.com
2	www.googletagmanager.com	app.groove.cm www.googletagmanager.com
2	cdn.productstash.io	app.groove.cm
2	f.vimeocdn.com	player.vimeo.com
2	i.vimeocdn.com	player.vimeo.com
2	player.vimeo.com	employeetaxrefund.com
2	employeetaxrefund.com	employeetaxrefund.com
1	d.turn.com	1 redirects
1	exchange.mediavine.com	employeetaxrefund.com
1	cdn.stickyadstv.com
1	ads.stickyadstv.com	1 redirects
1	criteo-partners.tremorhub.com	employeetaxrefund.com
1	jadserve.postrelease.com	employeetaxrefund.com
1	i6.liadm.com
1	match.sharethrough.com	employeetaxrefund.com
1	rtb-csync.smartadserver.com	employeetaxrefund.com
1	sync-t1.taboola.com	employeetaxrefund.com
1	criteo-sync.teads.tv	employeetaxrefund.com
1	s.ad.smaato.net	employeetaxrefund.com
1	contextual.media.net	employeetaxrefund.com
1	simage2.pubmatic.com	employeetaxrefund.com
1	pixel.rubiconproject.com	employeetaxrefund.com
1	cw.addthis.com	employeetaxrefund.com
1	sync.outbrain.com	employeetaxrefund.com
1	ups.analytics.yahoo.com	employeetaxrefund.com
1	ads.yahoo.com	employeetaxrefund.com
1	partner.mediawallahscript.com	employeetaxrefund.com
1	cm.g.doubleclick.net	1 redirects
1	c.bing.com	1 redirects
1	widget.us.criteo.com	app.groove.cm
1	sslwidget.criteo.com	1 redirects
1	videos.groovevideo.com	app.groove.cm
1	www.google.de	app.groove.cm
1	www.google.com	app.groove.cm
1	mug.criteo.com	app.groove.cm
1	googleads.g.doubleclick.net	www.googleadservices.com
1	175592.tracking.hyros.com	employeetaxrefund.com
1	static.criteo.net	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	www.google-analytics.com	www.googletagmanager.com
1	data.tooltip.io	cdn.tooltip.io
1	pp.signalayer.com	cdn.tooltip.io
1	cdn.tooltip.io	app.groove.cm
1	app.groovefunnels.com	1 redirects
1	widget.groovevideo.com	employeetaxrefund.com
1	kit.fontawesome.com	employeetaxrefund.com
147	73

This site contains links to these domains. Also see Links.

Domain
www.irs.gov

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-11-15` - `2022-11-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-01` - `2023-01-01`	a year	crt.sh
videos.groovevideo.com Amazon	`2021-07-05` - `2022-08-03`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.formsite.com Go Daddy Secure Certificate Authority - G2	`2022-03-03` - `2023-04-04`	a year	crt.sh
*.vimeocdn.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-05-18` - `2022-06-19`	a year	crt.sh
cdn.productstash.io R3	`2022-03-29` - `2022-06-27`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
cdn.tooltip.io R3	`2022-03-11` - `2022-06-09`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
api.loopedin.io R3	`2022-04-05` - `2022-07-04`	3 months	crt.sh
*.signalayer.com Amazon	`2022-02-01` - `2023-02-28`	a year	crt.sh
*.tooltip.io Amazon	`2022-03-18` - `2023-04-15`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-04-25` - `2022-06-15`	2 months	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2022-03-16` - `2022-09-16`	6 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-11` - `2022-07-13`	3 months	crt.sh
tracking.hyros.com Amazon	`2021-06-01` - `2022-06-30`	a year	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-11` - `2022-07-07`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-03-15` - `2022-09-07`	6 months	crt.sh
*.helpscout.net Amazon	`2022-04-18` - `2023-05-16`	a year	crt.sh
*.mediawallahscript.com Amazon	`2021-05-19` - `2022-06-17`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2022-01-11` - `2022-07-06`	6 months	crt.sh
*.outbrain.com Thawte RSA CA 2018	`2021-10-24` - `2022-11-24`	a year	crt.sh
odc-addthis-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-04-04`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2021-08-04` - `2022-09-04`	a year	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2022-02-20` - `2023-02-22`	a year	crt.sh
s.ad.smaato.net Amazon	`2021-09-21` - `2022-10-20`	a year	crt.sh
teads.tv R3	`2022-03-23` - `2022-06-21`	3 months	crt.sh
*.taboola.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-11-28` - `2022-12-29`	a year	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-01-25` - `2023-01-25`	a year	crt.sh
*.sharethrough.com Amazon	`2021-08-13` - `2022-09-11`	a year	crt.sh
*.postrelease.com Amazon	`2021-12-28` - `2023-01-25`	a year	crt.sh
*.tremorhub.com Amazon	`2022-03-24` - `2023-04-22`	a year	crt.sh
exchange.mediavine.com Amazon	`2021-08-05` - `2022-09-03`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://employeetaxrefund.com/
Frame ID: 231CD723393C35656C04B5659107120D
Requests: 44 HTTP requests in this frame

Frame: https://player.vimeo.com/video/682407368?portrait=0&transparent=1
Frame ID: E50F967B4AA9C7F99B54B93A3ADB40E3
Requests: 6 HTTP requests in this frame

Frame: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Frame ID: 2205871FAE28163D979D8EE7FACEF9D7
Requests: 51 HTTP requests in this frame

Frame: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Frame ID: F0AFD42251AF83683B78A967D0F2B078
Requests: 12 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?topUrl=employeetaxrefund.com&origin=onetag
Frame ID: 3E406DD33F089519FFE929A3D9C2EC2C
Requests: 2 HTTP requests in this frame

Frame: https://idsync.rlcdn.com/397596.gif?partner_uid=v9Y2MAbWefjtno3OMCa5lU9wu5evI8WI
Frame ID: 7848E1B74D744C39AD809F43D500429A
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ERC Application

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Criteo (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

//static\.criteo\.net/js/ld/ld\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)/jquery-ui(?:\.min)?\.js
jquery-ui.*\.js

Page Statistics

147
Requests

88 %
HTTPS

41 %
IPv6

56
Domains

73
Subdomains

62
IPs

9
Countries

8970 kB
Transfer

23692 kB
Size

56
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.irs.gov/pub/irs-drop/n-21-23.pdf
Title: Read Notice 2021-20 on the official IRS FAQ Site.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35

https://app.groovefunnels.com/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e HTTP 302
https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Request Chain 101

https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=employeetaxrefund.com&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=brd2knxsZkVEOGpOVnZsN0hBR3VRQWZxWWVLR0p6RDlnN1dFbWxlVXBmN0p4Y1RoT0dqOGRzUXIrODhYcGcrWVFuY2ttMis1U2FWQTNWSGpYa3VZYW1BdWM2L1RyckVUQkVzSmdlU3pmdTJOb3hyZDJwQTJ1Z0NMZlNqQUxXSjJsN25sL0VVbkR2WkJxbHN0UndNRzBlQmpQM05iVGMzdVNLZkN5NS9HbmFZZ2VqTTRHV3hnZXpTYWQ3cW1qNW9oYmZPVDJkT0ZpVU1WMkNMYmhuWDR3MExVUHdEMzI1QlRqeHBiTTFreW1PVnptOVhnMnJVN3Vpc2ZVSjJDUno0TndjajJxbVZGblJ5YlBPc0JxTi9mTERSVmxOcGRWYy9lM0EvdzNhcmZ4a01HbjRhTT18&cppv=2

Request Chain 108

https://sslwidget.criteo.com/event?a=81296&v=5.9.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeetaxrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=r-vNE19NWTRNbHRURnc3Rm9NdGVPQWUlMkJMSlBwYmdBclFOdzZzenV3VkQwSEpTRlZ4UWQlMkJKZVhCVHJCemNqeEtOcmlLOU96SlhyWUQlMkZwNnk0N1dZTEtIU1QyWVJoYm90b3RDYWZGOXd3Tk1kckcwV0Q5cXlkdnBPb282Nk5rZVBwTmd2SUlLc3ZFeVBUUWhIMU5Zb2dHQnJ4cXRkM0tJbGhUeUozWE9uQzBCc09WSW8lM0Q&tld=app.groove.cm&fu=https%3A%2F%2Femployeetaxrefund.com&dtycbr=76774 HTTP 302
https://widget.us.criteo.com/event?a=81296&v=5.9.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeetaxrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=r-vNE19NWTRNbHRURnc3Rm9NdGVPQWUlMkJMSlBwYmdBclFOdzZzenV3VkQwSEpTRlZ4UWQlMkJKZVhCVHJCemNqeEtOcmlLOU96SlhyWUQlMkZwNnk0N1dZTEtIU1QyWVJoYm90b3RDYWZGOXd3Tk1kckcwV0Q5cXlkdnBPb282Nk5rZVBwTmd2SUlLc3ZFeVBUUWhIMU5Zb2dHQnJ4cXRkM0tJbGhUeUozWE9uQzBCc09WSW8lM0Q&tld=app.groove.cm&fu=https%3A%2F%2Femployeetaxrefund.com&dtycbr=76774

Request Chain 112

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=81EC3FD81A16468393FC8283A8FCD104&RedC=c.clarity.ms&MXFR=0076B5267B2263E23D12A4B77F226D6A HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=81EC3FD81A16468393FC8283A8FCD104&MUID=1E0E39A21080653414A6283311EB64C5

Request Chain 113

https://gum.criteo.com/sync?c=6&r=1&k=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40 HTTP 302
https://idsync.rlcdn.com/397596.gif?partner_uid=v9Y2MAbWefjtno3OMCa5lU9wu5evI8WI

Request Chain 114

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay1NWUN0TUpUZjFZU1F3U0ZDM0R5WTg1eXBBbk1MQXUxX2l6TE9HQQ HTTP 302
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

Request Chain 123

https://secure.adnxs.com/setuid?entity=52&code=k-92Ol9ZTf1YSQwSFC3DyY85ypAnPPCIhLtK3Tyg&seg=95287 HTTP 307
https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-92Ol9ZTf1YSQwSFC3DyY85ypAnPPCIhLtK3Tyg%26seg%3D95287

Request Chain 124

https://ib.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D95287%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fgetuid%253Fhttps%253A%252F%252Fdis.criteo.com%252Fdis%252Frtb%252Fappnexus%252Fcookiematch.aspx%253Fappnxsid%253D%2524UID HTTP 302
https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1268435024720673585

Request Chain 126

https://eb2.3lift.com/xuid?mid=2711&xuid=k-cC-OypTf1YSQwSFC3DyY85ypAnMsSXZ80IXC0Q&dongle=013b HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-cC-OypTf1YSQwSFC3DyY85ypAnMsSXZ80IXC0Q&dongle=013b&gdpr=1&cmp_cs=&us_privacy=

Request Chain 128

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-HifI05Tf1YSQwSFC3DyY85ypAnP5vYkiWVv8rA HTTP 302
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-HifI05Tf1YSQwSFC3DyY85ypAnP5vYkiWVv8rA&C=1

Request Chain 130

https://x.bidswitch.net/sync?dsp_id=46&user_id=k-Oj7Q85Tf1YSQwSFC3DyY85ypAnM5zQCT5samXA&expires=30&user_group=5 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-Oj7Q85Tf1YSQwSFC3DyY85ypAnM5zQCT5samXA&expires=30&user_group=5

Request Chain 135

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-VRGOEZTf1YSQwSFC3DyY85ypAnMqfgTnCvs4gA HTTP 302
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-VRGOEZTf1YSQwSFC3DyY85ypAnMqfgTnCvs4gA

Request Chain 136

https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-O-vctpTf1YSQwSFC3DyY85ypAnNr8P6LFwwKkw HTTP 303
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-O-vctpTf1YSQwSFC3DyY85ypAnNr8P6LFwwKkw&_li_chk=true&previous_uuid=bcb0a9ff0f7b4d498753e4bcdbdf1341 HTTP 303
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-O-vctpTf1YSQwSFC3DyY85ypAnNr8P6LFwwKkw

Request Chain 139

https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-rwPfmpTf1YSQwSFC3DyY85ypAnPBUF_BLcZmhA&redirectId=69 HTTP 302
https://cdn.stickyadstv.com/one-shot/empty.gif

Request Chain 143

https://gum.criteo.com/sync?c=383&r=1&a=1&u=https%3A%2F%2Fd.turn.com%2Fr%2Fdd%2Fid%2FL2NzaWQvMS9jaWQvMTc0ODc0NDU2Ni90LzI%2Fdpuid%2F%40USERID%40%2Furl%2Fhttps%253A%252F%252Fdis.criteo.com%252Fdis%252Frtb%252Fcdb%252Fcookiematch.aspx%253F%2526extid%253D%2524!%7BTURN_UUID%7D HTTP 302
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODc0NDU2Ni90LzI/dpuid/MVMPhITII7MZGKExRi24gFRzsyUq5j3_/url/https%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fcdb%2Fcookiematch.aspx%3F%26extid%3D%24!%7BTURN_UUID%7D HTTP 302
https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=3755389855209047225

Request Chain 144

https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID HTTP 302
https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 302
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1268435024720673585

147 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
employeetaxrefund.com/ 880 KB
50 KB 308ms
256ms Document
text/html 2606:4700:3036::6815:294
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::6815:294 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85092d1f9cbaf7e078690e5e96ec46660608381b11b6405ef0c254c1717f84c5

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7017df984e2b6945-FRA
content-encoding: br
content-type: text/html
date: Mon, 25 Apr 2022 14:47:21 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Fri, 11 Mar 2022 21:02:39 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9FFLFKjqoXLBYaq2NpdSsc895B%2BMt7GPnU0JBj9BHPUcVTBW7kDFDOZtyQnYBWxD5WFRjWNxbf4sTNJ%2Brkhk26RyUbpOwH9A%2Bkll0ngpzJEKOMv1TBMQKnrfEkuPV%2FCEn5e%2Bo6UwqtXanULQlIz2AeW3TbE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 714 KB
137 KB 135ms
54ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

470041da41d6a3dd8dd3ff17882921f6c84d873151a6566ec9f1d971b7cfe401

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 14:38:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 14:47:22 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Apr 2022 14:47:22 GMT

GET
H2 200 inpage_published.css
app.groove.cm/groovepages/css/ 379 KB
54 KB 187ms
27ms Stylesheet
text/css 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovepages/css/inpage_published.css
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7bf94b0d401ae094f5888c0f504655e1945588cafdeecf952538b5f0d0b26639

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Apr 2022 12:56:18 GMT
server: cloudflare
age: 3245
etag: W/"62669a72-5ea1a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XgPuBDWsA35R36Ku%2FZdL4Nm9BhXovS3KqlVHuiB7qA2kv9EkTNREzMTAeO5gVPbhpDPQ%2FMZKGJfG6Z6%2B%2Fuw4IfpgA6wN3GaAIUgoIo53Fi1kv1eiz7InF5ws5Mp9dMWGIK%2B2AokwGdkVn9Bu"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017df9af942925c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 chunk-vendors.css
app.groove.cm/groovepages/css/ 0
0 180ms
20ms Stylesheet
text/html 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovepages/css/chunk-vendors.css
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

GET
H2 200 e7647a48d4.js Show response
kit.fontawesome.com/ 11 KB
4 KB 72ms
40ms Script
text/javascript 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kit.fontawesome.com/e7647a48d4.js

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a7249a1f634a0ecfc772e774a158a0ab74c354609558c382b130bf37a91b346

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Referer: https://employeetaxrefund.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:21 GMT
content-encoding: gzip
cf-cache-status: MISS
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-allow-methods: GET, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=60, public, must-revalidate
strict-transport-security: max-age=31536000; preload
cf-ray: 7017df9a2c0a68f2-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: FukrBbfel8jt8ZJTh2Si

GET
H2 200 css2
fonts.googleapis.com/ 695 KB
136 KB 106ms
106ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,700;0,900;1,400&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovepages/css/inpage_published.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fdb72fa6bec57bc4fdaa33ce375fa88d69fa6b6888279375826ea6e3f0ae609b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 14:47:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 14:47:22 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Apr 2022 14:47:22 GMT

GET
H2 200 free.min.css Show response
ka-f.fontawesome.com/releases/v5.15.4/css/ 59 KB
13 KB 63ms
28ms Fetch
text/css 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=e7647a48d4
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/e7647a48d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
via: 1.1 16aa5c15345b1c0756b83a5ae8ee765e.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA60-P2
x-cache: Hit from cloudfront
access-control-allow-methods: GET
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d0SIjSvKdeyFbAnq0WyH%2B2%2FNH8AVUeKDyzhSq%2Ff3do3CetVwF0obvfYliy%2FzzqX4rPXxETEEoBee6X9pNCdTJwyeaMayJsvNmt5iJ4w0dTA%2B%2Bw9Iupg5mSp%2BWOH7kiWqCsfH4p4LIuKrOD%2FlT%2FrFA3kTvg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 7017df9c6fd65bed-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: JYs3n-hGWZ44DpQSrs3-eWmmVl6cGMdz2jTwpTGkF7DWZrI5ixXsgQ==

GET
H2 200 free-v4-shims.min.css Show response
ka-f.fontawesome.com/releases/v5.15.4/css/ 26 KB
5 KB 61ms
27ms Fetch
text/css 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=e7647a48d4
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/e7647a48d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
via: 1.1 16aa5c15345b1c0756b83a5ae8ee765e.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA60-P2
x-cache: Hit from cloudfront
access-control-allow-methods: GET
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
etag: W/"76f34b71fc9fb641507ff6a822cc07f5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rm9%2BFotTMyNH%2FvNdx5HSt8JVKufxVn4dIG6PaumtJYl5JqK5saaOhcOnxQkM6eecpCah6oUGtAYwxMPD9yxCJYYD%2BOlQbiuxrHtvgMbNYOutlrGpm1FM3lAj0j8KB3oAo7awT2esre9oMBzr%2Fuf2OrRUAg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 7017df9c6fd95bed-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: qcL7OlOcsqgAxZv2DZSPez0muUEeOO0SWJ4WMMyx1ZK7UHq4lvn94Q==

GET
H2 200 free-v4-font-face.min.css Show response
ka-f.fontawesome.com/releases/v5.15.4/css/ 3 KB
1 KB 87ms
53ms Fetch
text/css 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-font-face.min.css?token=e7647a48d4
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/e7647a48d4.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
via: 1.1 8ac93eaf91328abbc6951d3fbab21e80.cloudfront.net (CloudFront)
vary: Accept-Encoding
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA60-P2
x-cache: Hit from cloudfront
access-control-allow-methods: GET
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Wed, 04 Aug 2021 18:53:09 GMT
server: cloudflare
etag: W/"f2e0b2680d9b0bcb6e0039c4424e5a59"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o9nq2qeUIwOWuh9hlXmFQuPbudMfwdyYfAD1IoaBX%2BaMkZ%2BHH27tlABLIdbA69q8zn6B3ncYGYtDcjwSSBWPYtBekh%2FEqjzG%2B92mqKbMhEpEx1DS9h2EmTFxzmaRuW%2Bv5z8874P3sQeyDaxagt91IUgBiw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 7017df9c6fd75bed-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: UcYC112FSMdvNEDE3NuSsc93L20PJGpGvkXHP9N_Vf0iyV0viUI5Qg==

GET
H2 200 matomo.js Show response
matomo.groovetech.io/ 63 KB
21 KB 83ms
23ms Script
application/javascript 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.js
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e0361122fe1fdced0bd7ae4c33f21d083f7b63a99e79a66b3111a943b160f70

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 10 Mar 2022 18:03:47 GMT
server: cloudflare
age: 7197
etag: W/"fa13-5d9e1091b9702-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0REkfSv%2F%2Fl%2FS43o%2B1de3GyujNy3%2BmtDEgjmImDUuLRBrOQ%2F3GCqsyZ6PIcbp7UXbOhK5wogn63lfm5Zq93Ggn%2FiS%2FIB5yD8CkQo9lkyM%2FZGdflVjZFpT%2Fr4F7xwns%2B4LzstZA3OMySfEwqZZkHV2WY4nDg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017df9c986e9b71-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK 682407368 Show response
player.vimeo.com/video/ Frame E50F 16 KB
9 KB 248ms
214ms Document
text/html 162.159.128.61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://player.vimeo.com/video/682407368?portrait=0&transparent=1

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.159.128.61 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

935724f2a78927b9d3a7ac543c34c66e6a86d3c57249ba176f5b582ba7c8071c

Security Headers

Name	Value
Content-Security-Policy	script-src 'self' 'unsafe-inline' blob: resource: https://f.vimeocdn.com https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://wirewax.s3.eu-west-1.amazonaws.com https://edge-assets.wirewax.com https://embedder-sdk.wirewax.com https://embedder-sdk.wirewax.tv https://f.vimeocdn.com; style-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://fonts.googleapis.com https://edge-assets.wirewax.com https://f.vimeocdn.com; connect-src 'self' ws: wss: https://vimeo.com https://vimeo.dev https://api.vimeo.com https://api.vimeo.dev https://.ci.vimeows.com https://csi.gstatic.com https://fresnel-player-staging.vimeows.com https://fresnel-event-staging.vimeows.com https://player-telemetry.vimeo.com https://.akamaized.net https://.akamaized-staging.net https://.vimeocdn.com https://netflux.cloud.vimeo.com https://lic.staging.drmtoday.com https://lic.drmtoday.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://sentry.io https://.ingest.sentry.io https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://backend.dna-delivery.com https://mimir.cloud.vimeo.com https://.wirewax.com https://.wirewax.tv https://wirewax.s3.eu-west-1.amazonaws.com https://sqs.us-east-1.amazonaws.com https://sqs.eu-west-1.amazonaws.com https://s3-eu-west-1.amazonaws.com https://cognito-identity.us-east-1.amazonaws.com https://cognito-identity.eu-west-1.amazonaws.com; media-src 'self' blob: https://.vimeocdn.com https://.akamaized.net https://.akamaized-staging.net https://.gvt1.com https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://devcaptions.cloud.vimeo.com/; object-src 'self' https://.vimeocdn.com https://.akamaized.net https://.akamaized-staging.net; default-src 'none'; font-src https://edge-assets.wirewax.com https://player.vimeo.com https://fonts.gstatic.com; img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://player.vimeo.com https://.ci.vimeows.com https://videoapi-sprites.vimeocdn.com https://i.vimeocdn.com https://wirewax.s3.eu-west-1.amazonaws.com https://studio-media.wirewax.com https://edge-assets.wirewax.com https://f.vimeocdn.com; frame-src 'self' https://imasdk.googleapis.com/ https://f.vimeocdn.com; report-uri /_csp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://employeetaxrefund.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 0
CF-Cache-Status: DYNAMIC
CF-RAY: 7017df9d3b0e6937-FRA
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: keep-alive
Content-Encoding: gzip
Content-Security-Policy: script-src 'self' 'unsafe-inline' blob: resource: https://f.vimeocdn.com https://vimeo.com https://js-agent.newrelic.com https://imasdk.googleapis.com/ https://adservice.google.com/ https://s0.2mdn.net/instream/video/ https://bam.nr-data.net https://src.litix.io https://www.gstatic.com https://cdn.streamroot.io https://wirewax.s3.eu-west-1.amazonaws.com https://edge-assets.wirewax.com https://embedder-sdk.wirewax.com https://embedder-sdk.wirewax.tv https://f.vimeocdn.com; style-src 'self' 'unsafe-inline' https://f.vimeocdn.com https://fonts.googleapis.com https://edge-assets.wirewax.com https://f.vimeocdn.com; connect-src 'self' ws: wss: https://vimeo.com https://vimeo.dev https://api.vimeo.com https://api.vimeo.dev https://*.ci.vimeows.com https://csi.gstatic.com https://fresnel-player-staging.vimeows.com https://fresnel-event-staging.vimeows.com https://player-telemetry.vimeo.com https://*.akamaized.net https://*.akamaized-staging.net https://*.vimeocdn.com https://netflux.cloud.vimeo.com https://lic.staging.drmtoday.com https://lic.drmtoday.com https://wv.service.expressplay.com https://fp.service.expressplay.com https://pr.service.expressplay.com https://sentry.io https://*.ingest.sentry.io https://storage.googleapis.com https://bam.nr-data.net https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://*.litix.io/ https://collector.vhx.tv https://collector.vhxstaging.com https://backend.dna-delivery.com https://mimir.cloud.vimeo.com https://*.wirewax.com https://*.wirewax.tv https://wirewax.s3.eu-west-1.amazonaws.com https://sqs.us-east-1.amazonaws.com https://sqs.eu-west-1.amazonaws.com https://s3-eu-west-1.amazonaws.com https://cognito-identity.us-east-1.amazonaws.com https://cognito-identity.eu-west-1.amazonaws.com; media-src 'self' blob: https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net https://*.gvt1.com https://live-api.cloud.vimeo.com https://live-api-dev.cloud.vimeo.com https://devcaptions.cloud.vimeo.com/; object-src 'self' https://*.vimeocdn.com https://*.akamaized.net https://*.akamaized-staging.net; default-src 'none'; font-src https://edge-assets.wirewax.com https://player.vimeo.com https://fonts.gstatic.com; img-src 'self' data: https://i.vimeocdn.com https://secure-b.vimeocdn.com https://f.vimeocdn.com https://vimeo.com https://secure.gravatar.com https://i0.wp.com https://i1.wp.com https://i2.wp.com https://pagead2.googlesyndication.com https://player.vimeo.com https://*.ci.vimeows.com https://videoapi-sprites.vimeocdn.com https://i.vimeocdn.com https://wirewax.s3.eu-west-1.amazonaws.com https://studio-media.wirewax.com https://edge-assets.wirewax.com https://f.vimeocdn.com; frame-src 'self' https://imasdk.googleapis.com/ https://f.vimeocdn.com; report-uri /_csp
Content-Type: text/html; charset=UTF-8
Date: Mon, 25 Apr 2022 14:47:22 GMT
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Expires: Mon, 25 Apr 2022 14:48:36 GMT
Link: <https://i.vimeocdn.com>; rel=preconnect; crossorigin <https://f.vimeocdn.com>; rel=preconnect; crossorigin <https://fresnel.vimeocdn.com>; rel=preconnect; crossorigin
P3p: CP="This is not a P3P policy! See https://vimeo.com/privacy"
Server: cloudflare
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: MISS
X-Cache-Hits: 0
X-Content-Type-Options: nosniff
X-Player-Backend: p
X-Served-By: cache-fra19127-FRA
X-Timer: S1650898042.462267,VS0,VE139
X-VServer: infra-playproxy-b-5
X-Varnish-Cache: 1
X-Vimeo-DC: ge
X-Xss-Protection: 1; mode=block

GET
H2 200 app.js Show response
widget.groovevideo.com/widget/ 171 KB
172 KB 147ms
28ms Script
application/javascript 2600:9000:2315:5400:b:d801:7900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://widget.groovevideo.com/widget/app.js
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:5400:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6b96faebeb046cd5224e65c3b937adccb309098c3f5437f997c2428353eaa9a1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 06:23:15 GMT
via: 1.1 ba922c695b86542cbfc03c782d8776d4.cloudfront.net (CloudFront)
last-modified: Fri, 01 Apr 2022 11:14:52 GMT
server: AmazonS3
age: 30248
etag: "fbd329faa662cfef22b3e61d93807bc4"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: DUS51-P2
accept-ranges: bytes
content-length: 175375
x-amz-cf-id: 5pk94SLo1j1itvuRSNnG_TaRV2ONkB3DCgyH_h-XHh0gWBzcN-g55w==

GET
H2 200 1597718141_diagram.png
assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/ 3 KB
4 KB 182ms
151ms Image
image/png 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/1597718141_diagram.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51f1ce6a509d26c957259cd2159a104fc59b1a883aef49071c57e04a9d157c28

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: MISS
x-guploader-uploadid: ADPycdteXxkGcd8TcSes5jombXf9C56ZkkfK8NXIAiK5m8_FQMVejumzrmcFaVBSNTFGtn15SZmKqjYXNGcH2T9sMbL8
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: image/png
content-length: 3482
last-modified: Tue, 18 Aug 2020 02:35:41 GMT
server: cloudflare
etag: "465d676f542e1fed0d38a67589dc766a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=KuB+dQ==, md5=Rl1nb1QuH+0NOKZ1idx2ag==
x-goog-generation: 1597718141588225
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 3482
accept-ranges: bytes
cf-ray: 7017df9d3a1a6961-FRA
expires: Mon, 25 Apr 2022 18:47:22 GMT

GET
H2 200 1597717671_deadline.png
assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/ 2 KB
2 KB 169ms
137ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/1597717671_deadline.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11c69bcd87891a42d96e5d30f79e017f7df78fb5d1b38c172bd8499afa53314d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=2675
x-guploader-uploadid: ADPycdv8ifODw1fP3o4XLntimhw85SZYhI_66ZAj_SnunQbwPe6uYG59gJA4tskPbKNg_BY6KvZE8W3OxNrY60GMJNg-BeptamE_
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1597717671_deadline.webp"
content-type: image/webp
content-length: 1988
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Tue, 18 Aug 2020 02:27:51 GMT
server: cloudflare
etag: "d6359770e28354b12c3872173e1ae8c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=Kwa5dQ==, md5=1jWXcOKDVLEsOHIXPhrowA==
x-goog-generation: 1597717671974940
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 2675
accept-ranges: bytes
cf-ray: 7017df9d3a1c6961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1597718121_hashtag.png
assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/ 3 KB
3 KB 161ms
129ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5df98d83cf362c0e9cf8723d/1597718121_hashtag.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5bc2e45266401b0277b4fd26fdc5fc09eece68f3f95455432553149a9d4065dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=4243
x-guploader-uploadid: ADPycdvGsmH1Sj6pSv88fuydWq_9AnwZPyuWNu0O1mF23OUfrFde083c1Cw51GpqLQAyQQCDHlul7OJ7qDeHWPU9pqTZdG-QsghK
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1597718121_hashtag.webp"
content-type: image/webp
content-length: 3040
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Tue, 18 Aug 2020 02:35:21 GMT
server: cloudflare
etag: "f70336704c1fd9b920a99a9aa2643a52"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=WW8kbQ==, md5=9wM2cEwf2bkgqZqaomQ6Ug==
x-goog-generation: 1597718121346867
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 4243
accept-ranges: bytes
cf-ray: 7017df9d3a1d6961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1636764264_1636484892rItGZ4vquWk.jpg
assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/ 569 KB
570 KB 195ms
163ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/1636764264_1636484892rItGZ4vquWk.jpg
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc41ffc9fb33501fcf5cb49b44c77dad397e6cb813ecb11ff30e3759bafac9ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: qual=85, origFmt=jpeg, origSize=1545579
x-guploader-uploadid: ADPycdsJ4sEWTAZXo-5KghW-IPYn-SOgoX8fLu5n_zNlYDmrBB_rZKtsQjEfIS0KQlLYao-aBRAja5YCNeC1zYN52od06aQYgx7-
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1636764264_1636484892rItGZ4vquWk.webp"
content-type: image/webp
content-length: 582588
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Sat, 13 Nov 2021 00:44:49 GMT
server: cloudflare
etag: "58cff4d7002c5b05cdc8ac66c900954e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=cjdusQ==, md5=WM/01wAsWwXNyKxmyQCVTg==
x-goog-generation: 1636764289885380
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 1545579
accept-ranges: bytes
cf-ray: 7017df9d3a1f6961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1636821952_salon1.jpg
assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/ 21 KB
22 KB 165ms
134ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/1636821952_salon1.jpg
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 204a2eedfab0e8fd23a8dcceae6d93c3c824ed90ef664b45e455283ea2145a7f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: qual=85, origFmt=jpeg, origSize=80052
x-guploader-uploadid: ADPycdvisqCxt4syobq1jVea_k3-mT5jylTsgzINHvGc_dnMWkeiFdlP3FNJL-9lKMEmYxJDjcPCJdZoy2-hhBfD63Uv
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1636821952_salon1.webp"
content-type: image/webp
content-length: 21720
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Sat, 13 Nov 2021 16:45:53 GMT
server: cloudflare
etag: "41320baf34832999fc9fa5afa08a9d76"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=3QSzfw==, md5=QTILrzSDKZn8n6WvoIqddg==
x-goog-generation: 1636821953137827
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 80052
accept-ranges: bytes
cf-ray: 7017df9d3a216961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1605594338_AdobeStock_232955923-scaled.jpeg
assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/ 341 KB
342 KB 169ms
138ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/1605594338_AdobeStock_232955923-scaled.jpeg
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b5b6dbacd834c25f8b7eecd19cae92f3d6ee6c14c2efffaeb7e6e0494a8d979

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: qual=85, origFmt=jpeg, origSize=606821
x-guploader-uploadid: ADPycdterOy_hJEhgwtgBKhAFMqqWGDy8zDz905VVhhcNeazQ-RIFDaJnSQYhddEpXcD3iTCgpnTBPMSOPZxHnzLsuM-
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1605594338_AdobeStock_232955923-scaled.webp"
content-type: image/webp
content-length: 348944
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Tue, 17 Nov 2020 06:25:39 GMT
server: cloudflare
etag: "2fc539f47bdf3f6aa1ed0d03966db744"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=mZ7Nug==, md5=L8U59HvfP2qh7Q0Dlm23RA==
x-goog-generation: 1605594339161447
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 606821
accept-ranges: bytes
cf-ray: 7017df9d3a246961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1636821807_pizza%20maker.jpg
assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/ 46 KB
46 KB 190ms
190ms Image
image/jpeg 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5dd590f1c586100f1285ee7a/1636821807_pizza%20maker.jpg
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d72a0fbde35c547caabc6cfaa2c6a9f4d60653d96f38a5fe6e064fe7c7e9ab7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: degrade=85, origSize=48844, status=webp_bigger
x-guploader-uploadid: ADPycdvjFO-IUz8KAlkwvRJSNYzcj6mQDzV8ZHVZKZ7HHqh4DCoXQQxhjZEuu2IYV88RwbClHQu9sl0et8HJCLViLvot
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: image/jpeg
content-length: 46989
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Sat, 13 Nov 2021 16:43:28 GMT
server: cloudflare
etag: "d78fdb31f953e78b8a59ae19747a8631"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=L4dLYQ==, md5=14/bMflT54uKWa4ZdHqGMQ==
x-goog-generation: 1636821808037187
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 48844
accept-ranges: bytes
cf-ray: 7017df9d4a2a6961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1602495767_Tree%20Removal%20AdobeStock_141600960-min.jpeg
assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/ 24 KB
24 KB 148ms
147ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/1602495767_Tree%20Removal%20AdobeStock_141600960-min.jpeg
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbfe54a0e52908626c069d2c012626ddb5cccd3989c1057156a36ee2fae89f04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: qual=85, origFmt=jpeg, origSize=35423
x-guploader-uploadid: ADPycdsIp5Yf31DFsIjIg8s6pdFKlwMctfPnh4pm8rXRoT3VSAtkszGkJeNhI8wG1L9Y00Sp-ZoUBw9Aea-jWPg3Dq60bYyOwSaq
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1602495767_Tree%20Removal%20AdobeStock_141600960-min.webp"
content-type: image/webp
content-length: 24396
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Mon, 12 Oct 2020 09:42:47 GMT
server: cloudflare
etag: "2b95bc80a2a426a9bf88c1f8c08f7be5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=V+q8Jg==, md5=K5W8gKKkJqm/iMH4wI975Q==
x-goog-generation: 1602495767959076
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 35423
accept-ranges: bytes
cf-ray: 7017df9d4a2d6961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1599638309_Screenshot%202020-09-09%20at%201.png
assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/ 94 KB
94 KB 149ms
148ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1599638309_Screenshot%202020-09-09%20at%201.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85635df68b8d195f5bd3b84eae58eb6bbef45ae3a8b6735860db715337f2e806

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=264509
x-guploader-uploadid: ADPycds-z9imfAupJaNdaWd3sx2llJ_OajhOK7LzRyEbIxivU0rTMXVUteydPyDVAsHrNrMJmprC_9xpkmCnmAGRVt-w6QzEjnpj
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1599638309_Screenshot%202020-09-09%20at%201.webp"
content-type: image/webp
content-length: 95814
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Mon, 16 Aug 2021 12:48:03 GMT
server: cloudflare
etag: "deac46339d2a9799a918573ba08a4e30"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=RSd0CA==, md5=3qxGM50ql5mpGFc7oIpOMA==
x-goog-generation: 1629118083149154
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 264509
accept-ranges: bytes
cf-ray: 7017df9d4a2f6961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1594987612_5-stars.png
assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/ 3 KB
4 KB 21ms
21ms Image
image/png 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1594987612_5-stars.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d653caafed24eae5bf173c7ab2ee4a42aeab1a72103538ae1cdb8202aab19723

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: EXPIRED
x-guploader-uploadid: ADPycdsnJ7TryR30WFs2frqSSVWoIN53XNgC31OmvmyEwf-99PWOl1eqSr-LG_bj_xPgEP3j8MKydcNysyM7J1Z702y5lA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-type: image/png
content-length: 3372
last-modified: Mon, 16 Aug 2021 12:46:54 GMT
server: cloudflare
etag: "8a3da401411e750e78b3a1e5a779aff5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=5vawBw==, md5=ij2kAUEedQ54s6Hlp3mv9Q==
x-goog-generation: 1629118014545462
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 3372
accept-ranges: bytes
cf-ray: 7017df9d4a316961-FRA
expires: Mon, 25 Apr 2022 18:47:22 GMT

GET
H2 200 1599638326_Screenshot%202020-09-09%20at%201.png
assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/ 59 KB
60 KB 148ms
147ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1599638326_Screenshot%202020-09-09%20at%201.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c0a96a2e0c97784664302304156b2a40db0a686791e1549ab6f42acc4b8ad9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=163384
x-guploader-uploadid: ADPycdvUjf15EL8t8UuMEAsJetSmNWjdD6CeepcwAms0ng9zP0Lez65GnzKlgCs4pzp0pPbnxn5dBL_n3jX3NtKwDFBEFwsX6bzE
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1599638326_Screenshot%202020-09-09%20at%201.webp"
content-type: image/webp
content-length: 60612
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Mon, 16 Aug 2021 12:48:03 GMT
server: cloudflare
etag: "367f5a51df3b5fd726f8a5d96f4ef149"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=mw6NCA==, md5=Nn9aUd87X9cm+KXZb07xSQ==
x-goog-generation: 1629118083333377
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 163384
accept-ranges: bytes
cf-ray: 7017df9d4a336961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1599638341_Screenshot%202020-09-09%20at%201.png
assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/ 52 KB
52 KB 144ms
144ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1599638341_Screenshot%202020-09-09%20at%201.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa1cf79fdb89e6ff28f4e17e1472de5fecb60884ab4625b01b5329ee6e7465b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=146342
x-guploader-uploadid: ADPycdt85JLnZc2pMO1oKKWCGNtVioc7E48tBRYfs2nzFyKlFyLyp58CTWlX-JvzG-ZDUraquaOg6XE2nWlMUl2m4nqz
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1599638341_Screenshot%202020-09-09%20at%201.webp"
content-type: image/webp
content-length: 52834
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Mon, 16 Aug 2021 12:48:03 GMT
server: cloudflare
etag: "e41b60d62cd1542f89aa8bd1b728eec5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=edP21A==, md5=5Btg1izRVC+JqovRtyjuxQ==
x-goog-generation: 1629118083514753
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 146342
accept-ranges: bytes
cf-ray: 7017df9d4a356961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1600932967_noun_Level%201_480108.png
assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/ 5 KB
5 KB 131ms
130ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1600932967_noun_Level%201_480108.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a00b9071e6f6fc2b7f45ee76bad85fc825037d1c0fca396462880b8378f3408

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=22514
x-guploader-uploadid: ADPycdtRUNeGZt8unP4ai7H12SGq1uOqe3parz7Ahl1-DK2jywowjwV3s3FzaL8qLP6VPRIxbsup2F-Fb-q9HgriURbXO2u4q-oN
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1600932967_noun_Level%201_480108.webp"
content-type: image/webp
content-length: 4630
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Mon, 16 Aug 2021 12:48:15 GMT
server: cloudflare
etag: "5c49649d511ae0cc6600d9a2e4365e77"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=MTCoSA==, md5=XElknVEa4MxmANmi5DZedw==
x-goog-generation: 1629118095617334
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 22514
accept-ranges: bytes
cf-ray: 7017df9d4a376961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1600933000_noun_Level%204_480114.png
assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/ 5 KB
5 KB 148ms
148ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1600933000_noun_Level%204_480114.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c177e9c84d392f24927bacc3365c8bb1515707a3c5dc159c14ab35a23d660a14

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=21680
x-guploader-uploadid: ADPycduVPcy51s_9gnUHlmoisZhnfFjrHDI6ZGmTU0Ns3vNc0HZZBX15PtaLjC_mbEdMpxg7ig-FJAF-Dh6gMcf2Brdv5A
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1600933000_noun_Level%204_480114.webp"
content-type: image/webp
content-length: 4646
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Mon, 16 Aug 2021 12:48:15 GMT
server: cloudflare
etag: "6681e3379942fe9e42e0caae81a9d49b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=M65Jaw==, md5=ZoHjN5lC/p5C4MquganUmw==
x-goog-generation: 1629118095786359
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 21680
accept-ranges: bytes
cf-ray: 7017df9d4a396961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1600933034_noun_Level%206_480107.png
assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/ 5 KB
5 KB 149ms
148ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ed66fb46b90b50c55d241c9/1600933034_noun_Level%206_480107.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eefcaed1e731e6269947209c907c643e8801654b1e6057d309cfbcdc790dd0ac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=20826
x-guploader-uploadid: ADPycdv3tqu_P845e-4XmqK9OxYkF6ZZtK5V4Eu3g_5zguXencuBbsmK7X3Mf-GNF6MkCOo7rD1odJqf0pGv0RjSEXZf1OgDmwPJ
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1600933034_noun_Level%206_480107.webp"
content-type: image/webp
content-length: 4732
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Mon, 16 Aug 2021 12:48:15 GMT
server: cloudflare
etag: "5661c65bb8df198418347af96de18ace"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=OQ0aOQ==, md5=VmHGW7jfGYQYNHr5beGKzg==
x-goog-generation: 1629118095961057
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 20826
accept-ranges: bytes
cf-ray: 7017df9d4a3a6961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 1636579332_Ring%20Dots%20Full.png
assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/ 3 KB
3 KB 130ms
130ms Image
image/webp 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.grooveapps.com/images/5ec1beec3df0ea0c586b63e7/1636579332_Ring%20Dots%20Full.png
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c1ae13164e1fc30ddc513415b482b060b775f1bc1eb6e18a865b07101956b0b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: REVALIDATED
cf-polished: origFmt=png, origSize=5671
x-guploader-uploadid: ADPycdtzkU6bQWk78W0aSTvp5vFpuQb-pre480V0c7cnhl6LyWObBQPNkiXJofoNLm1K9Emfjm3sSj0x7aJDXHSWqU_fyvoKFKIh
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-disposition: inline; filename="1636579332_Ring%20Dots%20Full.webp"
content-type: image/webp
content-length: 3086
expires: Mon, 25 Apr 2022 18:47:22 GMT
last-modified: Wed, 10 Nov 2021 21:22:13 GMT
server: cloudflare
etag: "6c7617edea8ca8b1802723c3b1a3e9bc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
x-goog-hash: crc32c=LcbNbQ==, md5=bHYX7eqMqLGAJyPDsaPpvA==
x-goog-generation: 1636579333178844
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=14400
x-goog-stored-content-length: 5671
accept-ranges: bytes
cf-ray: 7017df9d4a3b6961-FRA
cf-bgj: imgq:85,h2pri

GET
H2 200 form-validation-lib.web.js Show response
assets.grooveapps.com/plugins/ 7 KB
3 KB 191ms
190ms Script
application/javascript 2606:4700::6812:15b4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.grooveapps.com/plugins/form-validation-lib.web.js
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:15b4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f62806478a7a3181148a139c0873391c208d834b3650ed4f04edc75dca910c66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
content-encoding: br
cf-cache-status: MISS
x-guploader-uploadid: ADPycduxOQeBjSPpQ1Qi0OlkaUwI7_55Hk3Wup9HkBBJnKNfIZ1BFlnU2kzzCY1rq7Z1T6ddE02fh7VSnw9kGaCDWz0B
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
content-type: application/javascript
last-modified: Sat, 23 Apr 2022 10:18:55 GMT
server: cloudflare
etag: W/"e6fdbe9a815aa1ae0b338581c9326f04"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-goog-hash: crc32c=ga8vRQ==, md5=5v2+moFaoa4LM4WByTJvBA==
content-language: en
access-control-allow-origin: *
x-goog-generation: 1650709135660596
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000
x-goog-stored-content-length: 7339
cf-ray: 7017df9d4a286961-FRA
expires: Tue, 25 Apr 2023 14:47:22 GMT

GET
H3 200 email-decode.min.js Show response
employeetaxrefund.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 42ms
17ms Script
application/javascript 2606:4700:3036::6815:294
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://employeetaxrefund.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:294 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 20 Apr 2022 15:47:34 GMT
server: cloudflare
etag: W/"62602b16-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DCnP7p1qqMP4sC0CyxhxsHxs%2F3pRoTzxBKcklxCjeydq4SC7fVrUxxvq%2BooLnqpOGfeXzjiiHbynkPQ%2F1LKFRpep6Xj1HMMzb1vMkamuBagk5iq%2BWo7L7Q%2FCAtO8gzZ8Wdu1dym5NdKvaWE7AmZIi15H2AU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017df9d3d8a906d-FRA
vary: Accept-Encoding
expires: Wed, 27 Apr 2022 14:47:22 GMT

GET
H2 200 inpage_published.js Show response
app.groove.cm/groovepages/js/ 85 KB
31 KB 37ms
20ms Script
application/javascript 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovepages/js/inpage_published.js
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 345490564e186a5822be6706e4bb0b326bbb0fad2487eecc0d4d84ff03765d8f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Apr 2022 12:56:18 GMT
server: cloudflare
age: 3245
etag: W/"62669a72-15201"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BSFjSxYh4Jq5Ix3IuHLzcTZ5x8UuceUB0vXwHNQQjY49lb79OUz1X5%2BkgW%2FoDSOWoDddBqLLFYEWucevDBNjJP8%2BnjgD1mkRQG%2FBVtJEkr2E6H%2B2ud%2BTPrw9TsEcS0G0m68WQT33wfq%2B7uWf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017df9d2c77925c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 chunk-vendors.js Show response
app.groove.cm/groovepages/js/ 0
0 31ms
14ms Script
text/html 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovepages/js/chunk-vendors.js
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

GET
H2 200 pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v19/ 8 KB
8 KB 127ms
40ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v19/pxiByp8kv8JHgFVrLCz7Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Abril+Fatface&family=Amatic+SC:wght@400;700&family=Architects+Daughter&family=Asap:wght@400;700&family=Balsamiq+Sans:wght@400;700&family=Barlow:wght@400;700;900&family=Bebas+Neue&family=Bitter:wght@400;700;900&family=Cabin:wght@400;700&family=Cairo:wght@400;700&family=Cormorant+Garamond:wght@400;700&family=Crimson+Text:wght@400;700&family=Dancing+Script:wght@400;700&family=Fira+Sans:wght@400;700;900&family=Fjalla+One&family=Indie+Flower&family=Josefin+Sans:wght@400;700&family=Lato:wght@400;700;900&family=Libre+Baskerville:wght@400;700&family=Libre+Franklin:wght@400;700;900&family=Lobster&family=Lora:wght@400;700&family=Martel:wght@400;700;900&family=Merriweather:wght@400;700;900&family=Montserrat:wght@400;700;900&family=Mukta:wght@400;700&family=Noto+Sans+JP:wght@400;700&family=Noto+Sans+KR:wght@400;700;900&family=Noto+Sans:wght@400;700&family=Noto+Serif:wght@400;700&family=Nunito+Sans:wght@200;300;400;700;900&family=Nunito:wght@300;400;700;900&family=Old+Standard+TT:wght@400;700&family=Open+Sans+Condensed:wght@300;700&family=Open+Sans:wght@300;400;700&family=Oswald:wght@400;700&family=Overpass:wght@400;700;900&family=Oxygen:wght@300;400;700&family=PT+Sans+Narrow:wght@400;700&family=PT+Sans:wght@400;700&family=PT+Serif:wght@400;700&family=Pacifico&family=Playfair+Display:wght@400;700;900&family=Poppins:ital,wght@0,400;0,700;1,900&family=Raleway:wght@400;700;900&family=Roboto+Condensed:wght@400;700&family=Roboto+Slab:wght@400;700;900&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&family=Rubik:ital,wght@0,400;0,700;1,900&family=Shadows+Into+Light&family=Signika:wght@400;700&family=Slabo+27px&family=Source+Code+Pro:wght@400;700;900&family=Source+Sans+Pro:wght@400;700;900&family=Source+Serif+Pro:wght@400;700;900&family=Tajawal:wght@400;700;900&family=Titillium+Web:wght@400;700;900&family=Ubuntu:wght@400;700&family=Work+Sans:wght@400;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 19:30:15 GMT
x-content-type-options: nosniff
age: 415027
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7816
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:11:40 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 20 Apr 2023 19:30:15 GMT

GET
H3 200 free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/ 76 KB
77 KB 64ms
40ms Font
font/woff2 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-solid-900.woff2
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7

Request headers

Referer: https://employeetaxrefund.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
via: 1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA50-C1
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 78168
last-modified: Wed, 04 Aug 2021 18:58:24 GMT
server: cloudflare
etag: "a9fd1225fb2cd32320e2b931dca01089"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dZJwtgkkh5NtJeT73J5dtr4pdQ4WE1fVRYvDTAWdujCN3Tls%2BCH2Ly1DBbQy6woGPsUfrXqMORpjqm2j1JneWIjblUnlHOxD7Nc7AZMzaepugFOHaugneFt%2BiCW%2Fm95CsbBq%2ByaetM7CxJIyAVuUr8trRw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 7017df9d89d790fb-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: gYlGCpf1hDYnvpZB_CkGyWdoLjWR_qk_ft3fxLIvHiSB6W7nNw5mWw==

POST
H3 204 matomo.php
matomo.groovetech.io/ 0
567 B 101ms
81ms Ping
text/plain 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.php?action_name=employeetaxrefund.com%2FERC%20Application&idsite=4&rec=1&r=230534&h=14&m=47&s=22&url=https%3A%2F%2Femployeetaxrefund.com%2F&_id=c811363018246fdc&_idn=1&_refts=0&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&dimension1=61fbf5b9c9e6331d67340fd9&dimension2=wq08ZLnQc&pv_id=nGXJCj&pf_net=53&pf_srv=255&pf_tfr=448
Requested by: Host: matomo.groovetech.io
URL: https://matomo.groovetech.io/matomo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://employeetaxrefund.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.0.17
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M01dguOticZM3bRS13A9GlqtS51VegnZjNkFq4yHetQp74z2VAeczMS%2Fbu1L6017zbkP7rcnvej%2FoGPwLwrd3sqwUd02Gick%2BPBQCnvqQY0QOGdwgYzywOzzhFMAObB%2FLS%2Bvw0R66OuwqRdk9VaEFpBxUw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://employeetaxrefund.com
access-control-allow-credentials: true
cf-ray: 7017df9d9e229b8e-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 u1kHEnHT9wSJ2kyJJs0e
v1.gdapis.com/api/groovevideo/generate-css/75215/ 631 B
871 B 471ms
388ms Stylesheet
text/css 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/generate-css/75215/u1kHEnHT9wSJ2kyJJs0e
Requested by: Host: widget.groovevideo.com
URL: https://widget.groovevideo.com/widget/app.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash: 32bf052f6a566604ad88efa256ef360701cd270f9b4952e92577c2ebe601d9ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://employeetaxrefund.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.3.24
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hC3mW%2BKEx1Z8RIyM%2F%2FPx8I1ZAXcZa0NFsvygOxoaUOBypS0Nebg%2BhN%2FjCLPQRhHXknSlZkaGh3jbPGPWk15Ydef8iQaOec4M30NKBRR1gVOPsKYk9YmXIv%2BIFX18HpDDnEJ4JyqIovms2Vi9"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
x-ratelimit-remaining: 599
cache-control: no-cache, private
x-ratelimit-limit: 600
cf-ray: 7017df9f1b0291f6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2

200

u1kHEnHT9wSJ2kyJJs0e Show response
app.groove.cm/groovevideo/video/75215/ Frame 2205
Redirect Chain

https://app.groovefunnels.com/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

7 KB
3 KB

201ms
201ms

Document
text/html

2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Requested by: Host: widget.groovevideo.com
URL: https://widget.groovevideo.com/widget/app.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96e7467fa6eec2a64b2403a170731e21cce55dbbeff67055de09736b78246188

Request headers

Referer: https://employeetaxrefund.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7017df9f5ffa925c-FRA
content-encoding: br
content-type: text/html
date: Mon, 25 Apr 2022 14:47:22 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified: Mon, 25 Apr 2022 13:13:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F0k2LpswsCfd59ZzU%2Fz3WGT%2BQybkBK5Wdp9WNwPSt4J%2BiK42AIA3%2B7SF0JUJEjmBMEUEMwyBJqbZgrj1ScaEDGejwpaZHaFZRSQIaIVNIGpYZtfPisWNV1GXYd3vTtT0gYS07a62KbC8Z9of"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 7017df9f2f5f902a-FRA
date: Mon, 25 Apr 2022 14:47:22 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Thu, 01 Jan 1970 00:00:01 GMT
location: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TD5wHlu4xTc1VmT8rQ9b72SmzFf2%2BDGNqJP99ZviggyZehJ2MzXoA%2FEC0MbsV9ivTN8NZ6sTgXbiUSGFr%2FeeLS1HI2IKCngQV4%2BB9YfAZ0AR7OTGG5OIJUnNFpv%2Bnq2N%2BF5Lif2AHnT5Yzp3I%2F3I1ISL%2FnI%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

POST
H/1.1 204
No Content _csp
player.vimeo.com/ Frame E50F 0
1 KB 151ms
151ms Other
text/html 162.159.128.61
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://player.vimeo.com/_csp

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.159.128.61 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' https://f.vimeocdn.com; style-src 'self' https://f.vimeocdn.com; img-src 'self' https://i.vimeocdn.com https://f.vimeocdn.com
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://player.vimeo.com/video/682407368?portrait=0&transparent=1
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/csp-report

Response headers

Date: Mon, 25 Apr 2022 14:47:22 GMT
Via: 1.1 varnish
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
X-Cache: MISS
P3p: CP="This is not a P3P policy! See https://vimeo.com/privacy"
X-Host: player-v1136-5b7rp
Connection: keep-alive
Vary: Accept-Encoding
X-Xss-Protection: 1; mode=block
X-Served-By: cache-fra19133-FRA
X-Vimeo-DC: ge
X-Player-Backend: p
Server: cloudflare
X-Timer: S1650898043.692163,VS0,VE106
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: text/html; charset=UTF-8
Expires: Fri, 15 Dec 1985 19:30:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Content-Security-Policy: default-src 'self'; script-src 'self' https://f.vimeocdn.com; style-src 'self' https://f.vimeocdn.com; img-src 'self' https://i.vimeocdn.com https://f.vimeocdn.com
Accept-Ranges: bytes
CF-RAY: 7017df9ebdd56937-FRA
X-Cache-Hits: 0

GET
H3 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 127ms
40ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 17:58:32 GMT
x-content-type-options: nosniff
age: 420530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:20 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 20 Apr 2023 17:58:32 GMT

GET
H3 200 free-fa-regular-400.woff2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/ 13 KB
14 KB 31ms
30ms Font
font/woff2 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-f.fontawesome.com/releases/v5.15.4/webfonts/free-fa-regular-400.woff2
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 48fb6f0d8ac464d95cbc2df3ffa7bf5066950898c5581f5133d0565abb7f706b

Request headers

Referer: https://employeetaxrefund.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
via: 1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-cf-pop: FRA50-C1
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-methods: GET
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13216
last-modified: Wed, 04 Aug 2021 18:58:24 GMT
server: cloudflare
etag: "b8f1c6a3a94d42b082c29f0b1db8ba95"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8JdjCkRN49Yy27pKtTL5WMqcTdm5tR3O7kUxFZX8o0kDN5jdMs4Djklv7OsfU%2Fja5L5RmU%2FmNNoSNExUw5YbqkB1yimeOjjjMg18OqhLb9%2B2OSP6A7az0zb91Z1w5ROslINmAB3HAq7b%2B%2FA71KbXwQUdWQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 7017df9ecbde90fb-FRA
access-control-allow-headers: fa-kit-token
x-amz-cf-id: uPFT3ArFTByYKkrD09CiG9QoI2Hvab47NUaZvAddBoVpZiY_7vBcgw==

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v22/ 23 KB
23 KB 183ms
97ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 19:30:30 GMT
x-content-type-options: nosniff
age: 415012
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:14:03 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 20 Apr 2023 19:30:30 GMT

GET
H2 200 showFormEmbed Show response
fs22.formsite.com/res/ Frame F0AF 11 KB
3 KB 724ms
469ms Document
text/html 54.157.91.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.157.91.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-91-127.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 370b31e4f2c1d80be2fddb7ead12ed5ff81e02b36db5e297d3c2f0e039c60b68

Request headers

Referer: https://employeetaxrefund.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-length: 2817
content-type: text/html;charset=UTF-8
date: Mon, 25 Apr 2022 14:47:23 GMT
server: Apache
vary: Accept-Encoding,User-Agent

GET
H2 200 1383327404-6e5c79f6dc27afbddaf2b710f9b5163f84fefb19e0d203085c057fddf81e52e4-d.jpg
i.vimeocdn.com/video/ Frame E50F 1 KB
2 KB 37ms
10ms Image
image/jpeg 151.101.114.109
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.vimeocdn.com/video/1383327404-6e5c79f6dc27afbddaf2b710f9b5163f84fefb19e0d203085c057fddf81e52e4-d.jpg?mw=80&q=85
Requested by: Host: player.vimeo.com
URL: https://player.vimeo.com/video/682407368?portrait=0&transparent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: c388b25912be53e9f3dd747c322f90f507521d61899763ee8d232c8cb919abae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
via: vvarnish, 1.1 varnish, 1.1 varnish
age: 1737044
x-viewmaster-lossless-format: lossy
x-cache: miss, HIT, HIT
x-backend-server: varnish
content-length: 1462
viewmaster-server: viewmaster-us-central1-cshw
x-served-by: cache-dfw18620-DFW, cache-hhn4070-HHN
x-timer: S1650898043.742985,VS0,VE1
etag: ed98e8e9b9fea40264eccb6e465b1778
access-control-max-age: 86400
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: X-Viewmaster-Status
cache-control: public, max-age=2592000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 player.de-DE.js Show response
f.vimeocdn.com/p/3.51.13/js/ Frame E50F 796 KB
189 KB 35ms
9ms Script
application/javascript 151.101.14.109
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://f.vimeocdn.com/p/3.51.13/js/player.de-DE.js
Requested by: Host: player.vimeo.com
URL: https://player.vimeo.com/video/682407368?portrait=0&transparent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e6fe608076a26c25128ade42e19548ebc9b56ec208f743d671b096d860ab9446

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
via: 1.1 varnish, 1.1 varnish
age: 341966
x-served-by: cache-iad-kcgs7200060-IAD, cache-fra19126-FRA
vary: Accept-Encoding,x-http-method-override
x-cache: HIT, HIT
content-type: application/javascript
content-encoding: br
cache-control: max-age=1209600
accept-ranges: bytes
x-timer: S1650898043.743220,VS0,VE0
content-length: 193645
x-cache-hits: 1, 26327

GET
H2 200 player.css
f.vimeocdn.com/p/3.51.13/css/ Frame E50F 213 KB
21 KB 32ms
7ms Stylesheet
text/css 151.101.14.109
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://f.vimeocdn.com/p/3.51.13/css/player.css
Requested by: Host: player.vimeo.com
URL: https://player.vimeo.com/video/682407368?portrait=0&transparent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 34a358865a90e248b5bcc9bc1fc89c1308ae483c98a3ca7180d70b4dcfa8cc28

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
via: 1.1 varnish, 1.1 varnish
age: 341966
x-served-by: cache-iad-kjyo7100173-IAD, cache-fra19126-FRA
vary: Accept-Encoding,x-http-method-override
x-cache: HIT, HIT
content-type: text/css
access-control-allow-origin: *
content-encoding: br
cache-control: max-age=1209600
accept-ranges: bytes
x-timer: S1650898043.743042,VS0,VE0
content-length: 20830
x-cache-hits: 1, 105350

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
15 KB 107ms
66ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 01:46:21 GMT
x-content-type-options: nosniff
age: 306061
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Apr 2023 01:46:21 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v19/ 13 KB
13 KB 152ms
112ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v19/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 18:04:09 GMT
x-content-type-options: nosniff
age: 420193
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12924
x-xss-protection: 0
last-modified: Wed, 23 Feb 2022 17:39:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Apr 2023 18:04:09 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v19/ 13 KB
13 KB 163ms
123ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v19/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 18:03:30 GMT
x-content-type-options: nosniff
age: 420232
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 23 Feb 2022 17:39:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Apr 2023 18:03:30 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v19/ 12 KB
12 KB 119ms
80ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v19/6xKydSBYKcSV-LCoeQqfX1RYOo3iu4nwlxdu.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

080e18a8c761c3d30b7ec08aa65f87109a0228367eafd0a12fcefda58d10e8ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 18:09:20 GMT
x-content-type-options: nosniff
age: 419882
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12408
x-xss-protection: 0
last-modified: Wed, 23 Feb 2022 17:39:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Apr 2023 18:09:20 GMT

GET
H3 200 TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2
fonts.gstatic.com/s/oswald/v47/ 17 KB
17 KB 122ms
83ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/oswald/v47/TK3IWkUHHAIjg75cFRf3bXL8LICs1_Fv40pKlN4NNSeSASz7FmlWHYg.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0982166468cc0ec6e23155f10397456c908a0599e4eac7dd0d81431843ca503f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Thu, 21 Apr 2022 23:31:09 GMT
x-content-type-options: nosniff
age: 314173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17864
x-xss-protection: 0
last-modified: Thu, 24 Feb 2022 18:07:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 21 Apr 2023 23:31:09 GMT

GET
H3 200 BngRUXNadjH0qYEzV7ab-oWlsbCGwR0.woff2
fonts.gstatic.com/s/ptsansnarrow/v16/ 35 KB
35 KB 168ms
128ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsansnarrow/v16/BngRUXNadjH0qYEzV7ab-oWlsbCGwR0.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38ba9bd69a8f6114511656eed8cf0f4e3d45d9e2c9aa0a22fb978d5da5ac250b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://employeetaxrefund.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 20:03:47 GMT
x-content-type-options: nosniff
age: 413015
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36220
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:13:07 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 20 Apr 2023 20:03:47 GMT

GET
H2 200 1383327404-6e5c79f6dc27afbddaf2b710f9b5163f84fefb19e0d203085c057fddf81e52e4-d
i.vimeocdn.com/video/ Frame E50F 14 KB
14 KB 130ms
129ms Image
image/avif 151.101.114.109
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.vimeocdn.com/video/1383327404-6e5c79f6dc27afbddaf2b710f9b5163f84fefb19e0d203085c057fddf81e52e4-d?mw=600&mh=338
Requested by: Host: player.vimeo.com
URL: https://player.vimeo.com/video/682407368?portrait=0&transparent=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0a43760f80608326612094f7ebbbbad42e5e24710fe8baa90d5c3684eeeaf656

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://player.vimeo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
via: vvarnish, 1.1 varnish, 1.1 varnish
age: 465873
x-viewmaster-lossless-format: automatic
x-cache: miss, HIT, MISS
access-control-max-age: 86400
x-backend-server: varnish
content-length: 13967
viewmaster-server: viewmaster-us-central1-c0mn
x-served-by: cache-dfw18672-DFW, cache-hhn4070-HHN
x-timer: S1650898043.867461,VS0,VE122
etag: 5443166ce4e515332beee6d8187b48d1
vary: Accept
content-type: image/avif
access-control-allow-origin: *
access-control-expose-headers: X-Viewmaster-Status
cache-control: public, max-age=2592000
accept-ranges: bytes
x-cache-hits: 1, 0

GET
H2 200 video-js.min.css
cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame 2205 39 KB
9 KB 148ms
109ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video-js.min.css

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91f94a3c7e05d1c1afd01260e88ebea5be6720ed3514c7a82bba96a33d4d6b21

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 7798940
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9046
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:35 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0401f-9c5c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IId5hNgMsojZZ1YYEpc9nQIFI6Ix1m7XdZ5LIqBr9NLBWjhbaH1iVrkJ9JmRn%2BJ3an%2F0Aw77CbCUwh94Quhf1vMTBLrWQ6qyX%2Bylffooo10TrAOitqN2ZFT%2Ffv1PGHyvRXyYAcUpM%2B2sB3zzdJnCy1cK"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 7017dfa0fd4b9b7c-FRA
expires: Sat, 15 Apr 2023 14:47:23 GMT

GET
H2 200 video.min.js Show response
cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/ Frame 2205 470 KB
106 KB 93ms
53ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/video.js/7.6.6/video.min.js

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19bd09a46cd5735572bec1a138df1d0c1d408767e59c890581a417bdfcd29b25

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 189357
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 107564
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:35 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0401f-757c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iPgkwHjTPA7M%2FAAv78KGflXpIdXNCaUeMDAEWNNwRfq9wFGK%2BnLpGx70gb1PJLIOfbW6i0zG45fPOon1LHac4SfBGUygEdEdiovNxQiYvCSzRP9fJoEfvZZKP2tRCptBgrE35WFUgB70u7RwigwXqawk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 7017dfa0fd4e9b7c-FRA
expires: Sat, 15 Apr 2023 14:47:23 GMT

GET
H2 200 videojs-ie8.min.js Show response
cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/ Frame 2205 19 KB
6 KB 147ms
108ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/video.js/5.2.2/ie8/videojs-ie8.min.js

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6cdefb09aa8ed6fcfcb5ee50239a85d38f1a700653ce9f0420878508c07925ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1630673
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5911
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:34 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb0401e-4a99"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lnd3K2RQdLsTnzcu1DxAq%2FViUcfIhlOQAabGad%2B12MX%2BNbwnZOT0mtu6k8MN0NGJ2Le8gWAQMTA%2Be%2BBYs7zXra7lGrsoQbeaQKRDCtonjaj9fkL9F9JyAxezQQwFJfV4%2BmEaEbweT34Ru0u240%2B%2BhUqp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 7017dfa0fd509b7c-FRA
expires: Sat, 15 Apr 2023 14:47:23 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame 2205 12 KB
792 B 70ms
68ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,wght@0,300;0,400;0,600;0,700;0,800;0,900;1,400&display=swap

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1c8894064a04f2ac7b3e03d6cb7ac9028b08bd2f24b69971319c04ef0cf5aed5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 14:47:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 14:47:23 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Apr 2022 14:47:23 GMT

GET
H2 200 animate.min.css
cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/ Frame 2205 70 KB
4 KB 148ms
109ms Stylesheet
text/css 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1244668
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4216
timing-allow-origin: *
last-modified: Mon, 07 Sep 2020 12:33:38 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f5628a2-11846"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WGDL5nsNrRP3f6uwsc8Sq6CmWZS6wkV%2Bvtw%2BbAXq8lYrWZEvGVLPVe2EcER%2FSCbcD0KGWNiG9QDtdJ%2FSnt2Br8Ns42VefF9ogLRWo01o1s8Uj44cSbr7VjH%2BmqyR%2BaSz0n2DBzlOq%2BkGGR%2FjCCo4aoYt"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 7017dfa0fd4c9b7c-FRA
expires: Sat, 15 Apr 2023 14:47:23 GMT

GET
H2 200 app.d39a4935.css
app.groove.cm/groovevideo/css/ Frame 2205 61 KB
11 KB 16ms
15ms Stylesheet
text/css 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/css/app.d39a4935.css
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c0c9a4f30d5474fd68e2242edb082b8300ef5876fd3405f1d4fbbe9127a8b56

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:22 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Apr 2022 13:13:03 GMT
server: cloudflare
age: 3184
etag: W/"62669e5f-f2ea"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BBOriWWtim3zLa%2BmMrzIrX0Tp5GUojq1LGLtYSeVcMu5rMWNd9F0Bz%2BpePpKIVG%2F8DXS5N2xLNjABQ96bPQx%2FzaHY%2FqHf8AO6cbdZ08V8dRsspum5bgT4r0nDhHjXnQss8cLgNfGNkCej6Tq"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017dfa0a9cf925c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 chunk-vendors.a135f666.css
app.groove.cm/groovevideo/css/ Frame 2205 2 MB
215 KB 24ms
23ms Stylesheet
text/css 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/css/chunk-vendors.a135f666.css
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b558de5c9eefc9189ce63df5c4d1bfe9932660fd3f013c5c676df0814e952c6f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Apr 2022 13:13:03 GMT
server: cloudflare
age: 3184
etag: W/"62669e5f-1e8865"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sajkjl9I6Ycm0nUgYRCNb5MFYkQYJq%2FKjeWOjQ5o%2BPOwdlBvadNkp9cGKaqSCGZEA91AYYODfOh9rpmZxfV2rx0SPVf%2F5KHYerhD4FxCLkfpse2bonSbpav3RGUhsoy8qeLuCZMgDkxifuH%2F"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017dfa0b9d2925c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 app.28e56345.js Show response
app.groove.cm/groovevideo/js/ Frame 2205 2 MB
325 KB 31ms
31ms Script
application/javascript 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/js/app.28e56345.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d622d40ae1e8015c10ca7738ddad1e3963cc495922acc38cec16a57f9bd99a98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Apr 2022 13:13:03 GMT
server: cloudflare
age: 3184
etag: W/"62669e5f-1a57c1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YRkQyzuo5vBJkKpZXm7MkfIDLXu2EfDfUihWeDE431br0a6gxmoLdLbdS89YJ6XM%2BJPa6qDfBjSSQEgip42g1OLlDq34h7SVp5uMPtcAQQAYz%2BT8nQ%2Bu5s6cBbn9YFMdbgM1gyuYMY48bZKb"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017dfa0b9d3925c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 chunk-vendors.fc86ae3f.js Show response
app.groove.cm/groovevideo/js/ Frame 2205 7 MB
2 MB 47ms
47ms Script
application/javascript 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/groovevideo/js/chunk-vendors.fc86ae3f.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f2518532bdaa3fd66fe386beeafee4119dddbabc01e86f332ae8df187097bc3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Apr 2022 13:13:03 GMT
server: cloudflare
age: 3185
etag: W/"62669e5f-7744c8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dyZVxxeNl%2FyCRXd2ASTVsT8MSjV8wb6Qv%2Fsph%2Ffc%2BRkcav30bGChrlsIdMNrqytE8hqhJeY%2FZJHZ8WNfZDcxhd1GJ63EDE9elUTTp0Gx919rBtnid4eHGQkjP3L5B10cxD2x%2BEotFculLJMl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017dfa0b9d4925c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 widget.min.js Show response
cdn.productstash.io/js/ Frame 2205 23 KB
6 KB 140ms
21ms Script
application/javascript 84.17.46.53
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.productstash.io/js/widget.min.js?v=0.8

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.17.46.53 Amsterdam, Netherlands, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

unn-84-17-46-53.cdn77.com

Software

BunnyCDN-AMS1-879 /

Resource Hash

6240744a19f326be4e22778eb7c5a39abce05826a8728531b9fddc0a75863e8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 883
x-dns-prefetch-control: off
cdn-cachedat: 03/10/2022 13:35:11
cdn-pullzone: 173232
content-encoding: br
vary: Accept-Encoding, Accept-Encoding
x-xss-protection: 1; mode=block
server: BunnyCDN-AMS1-879
last-modified: Sun, 06 Feb 2022 15:21:19 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"5bd1-17ecfa00998"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: application/javascript; charset=UTF-8
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: 828b3e55ce3e7001dc935b69d47b095b
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
BLOB 200
OK 5526fe59-5f3c-4f69-a81d-fbf52a459d26
https://app.groove.cm/ Frame 2205 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/5526fe59-5f3c-4f69-a81d-fbf52a459d26
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 2205 208 KB
73 KB 141ms
57ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f61d0efe366479ed9a5c08ca2289d1fd9b912a4070bc4aec4206559f20677c44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74083
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 25 Apr 2022 14:47:23 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame 2205 714 KB
136 KB 64ms
64ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/css/chunk-vendors.a135f666.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

470041da41d6a3dd8dd3ff17882921f6c84d873151a6566ec9f1d971b7cfe401

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 25 Apr 2022 14:34:07 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 25 Apr 2022 14:47:23 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 25 Apr 2022 14:47:23 GMT

GET
H2 200 player.js Show response
cdn.tooltip.io/static/ Frame 2205 471 KB
80 KB 182ms
12ms Script
application/javascript 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.tooltip.io/static/player.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 8349d9a9ffc87ffcdb0f6671e9d9709d7e4aa6cd851628ae81d294ab4001189d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: gzip
x-amz-request-id: 9MRBE1ESRMY3ZT3J
x-edge-location: defr
x-cache: HIT
content-length: 81741
x-amz-id-2: 2vaNfJSWblUD1srISWv/EVUa+w2+MIMpYKh/fgyHbYG9hjZANXPH/8XOxucr/jrKeQjYm7j5JUU=
last-modified: Mon, 22 Nov 2021 13:04:15 GMT
server: keycdn-engine
etag: "2896ec2e8a5ff49a48bd72727bd02ce2"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=604800
accept-ranges: bytes
link: <https://s3.amazonaws.com/tooltip-static-player/static/player.js>; rel="canonical"
expires: Mon, 02 May 2022 14:47:23 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ Frame 2205 980 B
2 KB 185ms
68ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.fc86ae3f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

15281cd70032aeb02042c6f7d50f7b5312dc2e7f2b4bc700cdb29561d115a95b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Mon, 25 Apr 2022 14:47:24 GMT

GET
H3 200 matomo.js Show response
matomo.groovetech.io/ Frame 2205 63 KB
21 KB 50ms
50ms Script
application/javascript 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.js
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.fc86ae3f.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e0361122fe1fdced0bd7ae4c33f21d083f7b63a99e79a66b3111a943b160f70

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 10 Mar 2022 18:03:47 GMT
server: cloudflare
age: 7198
etag: W/"fa13-5d9e1091b9702-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v%2FDYCfimVIV%2FYnYx3BnK2XeoZ46tsJdxXRZFBZxscxOQAkGTsc9pNUOT4NtPCNwoJupU8c4uh2M3%2BT6C6IUfOw04PV9vU%2BD7R5opZkN%2B3k0BMmoQs1iWU7qRMr6phxWu%2BoREqwnb73liYQj3L0LqWksOfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017dfa689919b8e-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
BLOB 200
OK 5e3b41eb-ac23-47b6-9494-cbbbe9c55b48 Show response
https://app.groove.cm/ Frame 2205 97 B
0 Script
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://app.groove.cm/5e3b41eb-ac23-47b6-9494-cbbbe9c55b48
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.fc86ae3f.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c0e5ae6bdbd6cc1a2a13e17aeb81bfe8c6c4da8a3c198c26513c5305e404a479

Request headers

Referer
Origin: https://app.groove.cm
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Length: 97
Content-Type: text/javascript

GET
H2 200 jquery-ui.css
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/ Frame F0AF 36 KB
8 KB 297ms
173ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 04:30:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296235
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8422
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Apr 2023 04:30:09 GMT

GET
H2 200 fonts8.css
fs22.formsite.com/include/form/ Frame F0AF 20 KB
5 KB 120ms
118ms Stylesheet
text/css 54.157.91.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/fonts8.css?1531236272143
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.157.91.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-91-127.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 9221b2c07e1ad6a168982f0fbb342131b2e96c0ebe5902d98653d3a546a34632

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: gzip
last-modified: Thu, 21 Oct 2021 13:46:26 GMT
server: Apache
etag: "4e63-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 4202
expires: Mon, 02 May 2022 14:47:23 GMT

GET
H2 200 screen8.css
fs22.formsite.com/include/form/ Frame F0AF 20 KB
9 KB 235ms
233ms Stylesheet
text/css 54.157.91.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/screen8.css?1531236272143
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.157.91.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-91-127.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 4102849464f8d41001ff6ba10d0c6f0051118e82f80738718bf49f127e2e0c13

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: gzip
last-modified: Mon, 18 Apr 2022 13:54:27 GMT
server: Apache
etag: "4f66-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 8173
expires: Mon, 02 May 2022 14:47:23 GMT

GET
H2 200 responsive8.css
fs22.formsite.com/include/form/ Frame F0AF 3 KB
1 KB 117ms
115ms Stylesheet
text/css 54.157.91.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/responsive8.css?1531236272143
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.157.91.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-91-127.compute-1.amazonaws.com
Software: Apache /
Resource Hash: faa7999a9bc916746448d20ba389c7360faea9bc01a9e53fc08275e565cbf399

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: gzip
last-modified: Wed, 10 Nov 2021 15:07:12 GMT
server: Apache
etag: "bb2-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 876
expires: Mon, 02 May 2022 14:47:23 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ Frame F0AF 87 KB
88 KB 306ms
183ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Sun, 24 Apr 2022 18:10:00 GMT
x-content-type-options: nosniff
age: 74244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89501
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 24 Apr 2023 18:10:00 GMT

GET
H2 200 jquery-ui.min.js Show response
ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/ Frame F0AF 248 KB
67 KB 191ms
68ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Fri, 22 Apr 2022 04:30:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 296235
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67948
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 22 Apr 2023 04:30:09 GMT

GET
H2 200 form8.js Show response
fs22.formsite.com/include/form/ Frame F0AF 27 KB
8 KB 237ms
236ms Script
application/javascript 54.157.91.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/form8.js?1531236272143
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.157.91.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-91-127.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 7b47ae80afa3203ba35b6f17e9a9c0641ac3f8f5d37b3ae9f01f06730b1e7ae6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: gzip
last-modified: Wed, 10 Nov 2021 15:07:12 GMT
server: Apache
etag: "6c5c-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=604800
accept-ranges: bytes
content-length: 7457
expires: Mon, 02 May 2022 14:47:23 GMT

GET
H2 200 embed.js Show response
fs22.formsite.com/include/form/ Frame F0AF 2 KB
1 KB 237ms
236ms Script
application/javascript 54.157.91.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/embed.js
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.157.91.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-91-127.compute-1.amazonaws.com
Software: Apache /
Resource Hash: 9bf76c0981f3d7cb30be16f19b1419bad27dbccc3c5c5496cd1c84982e756dd8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: gzip
last-modified: Mon, 30 Mar 2020 16:25:53 GMT
server: Apache
etag: "8fe-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: max-age=604800
accept-ranges: bytes
content-length: 855
expires: Mon, 02 May 2022 14:47:23 GMT

OPTIONS
H/1.1 204
No Content ping
api.loopedin.io/v1/users/ Frame 0
0 248ms
53ms Preflight 54.216.252.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-216-252-255.eu-west-1.compute.amazonaws.com

Software

Cowboy /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://app.groove.cm
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Access-Control-Allow-Headers: Content-Type,Authorization
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 0
Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Date: Mon, 25 Apr 2022 14:47:24 GMT
Expect-Ct: max-age=0
Referrer-Policy: no-referrer
Server: Cowboy
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Xss-Protection: 0

POST
H/1.1 200
OK ping Show response
api.loopedin.io/v1/users/ Frame 2205 3 B
1 KB 60ms
60ms Fetch
application/json 54.216.252.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/v1/users/ping

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-216-252-255.eu-west-1.compute.amazonaws.com

Software

Cowboy /

Resource Hash

27badc983df1780b60c2b3fa9d3a19a00e46aac798451f0febdca52920faaddf

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/json

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Mon, 25 Apr 2022 14:47:24 GMT
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 3
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
X-Frame-Options: SAMEORIGIN
Etag: W/"3-n5rwKVhboBTgfNORDKl2z1YWBhY"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 48
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1650898058
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H/1.1 200
OK app-config Show response
api.loopedin.io/ Frame 2205 525 B
2 KB 241ms
47ms XHR
application/json 54.216.252.255
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.loopedin.io/app-config?product_id=f634edf5-70e7-429d-8c94-c26dfaeaee26&timestamp=0&public=true&user=public&domain=app.groove.cm

Requested by

Host: cdn.productstash.io
URL: https://cdn.productstash.io/js/widget.min.js?v=0.8

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.216.252.255 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-216-252-255.eu-west-1.compute.amazonaws.com

Software

Cowboy /

Resource Hash

077c7d2685920baeb6b3149d52195580a502973eddcbfc6e1b3fd8bede3e477d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Via: 1.1 vegur
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Dns-Prefetch-Control: off
Date: Mon, 25 Apr 2022 14:47:24 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=15552000; includeSubDomains
Vary: Accept-Encoding
Content-Length: 525
X-Xss-Protection: 0
Referrer-Policy: no-referrer
Server: Cowboy
Etag: W/"20d-MlWI4ifS92rTNQya5u17VMJrMh4"
Expect-Ct: max-age=0
X-Ratelimit-Remaining: 49
Access-Control-Allow-Methods: GET
X-Download-Options: noopen
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
X-Ratelimit-Reset: 1650898058
X-Ratelimit-Limit: 50
Content-Type: application/json; charset=utf-8

GET
H2 200 notification.png
cdn.productstash.io/images/ Frame 2205 1 KB
2 KB 41ms
41ms Image
image/png 84.17.46.53
CDN77 ^_^

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.productstash.io/images/notification.png

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

84.17.46.53 Amsterdam, Netherlands, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

unn-84-17-46-53.cdn77.com

Software

BunnyCDN-AMS1-879 /

Resource Hash

87608a8dea58460e4b38f3445a737f999eb6a62dee361be55e06625d505c4e5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
via: 1.1 vegur
x-content-type-options: nosniff
cdn-edgestorageid: 879
x-dns-prefetch-control: off
cdn-cachedat: 03/30/2022 02:18:45
cdn-pullzone: 173232
content-length: 1156
x-xss-protection: 1; mode=block
server: BunnyCDN-AMS1-879
last-modified: Tue, 29 Mar 2022 21:10:08 GMT
cdn-proxyver: 1.02
cdn-requestpullcode: 200
x-frame-options: SAMEORIGIN
etag: W/"484-17fd783b780"
x-download-options: noopen
strict-transport-security: max-age=15552000; includeSubDomains
content-type: image/png
cdn-cache: HIT
cdn-uid: 48a72dd7-1732-4103-a906-fc257bffa1c1
cache-control: public, max-age=31536000
cdn-requestid: e806c10d011f54d848415e5b801542ea
accept-ranges: bytes
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 print8.css
fs22.formsite.com/include/form/ Frame F0AF 375 B
768 B 132ms
132ms Stylesheet
text/css 54.157.91.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fs22.formsite.com/include/form/print8.css?1531236272143
Requested by: Host: fs22.formsite.com
URL: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.157.91.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-157-91-127.compute-1.amazonaws.com
Software: Apache /
Resource Hash: fe096c1a1b3636490559c3e3d5c51dedcfed669ef95394071a765d922937dc6d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fs22.formsite.com/res/showFormEmbed?EParam=m_OmK8apOTBq9zAPECUmc4YvBMmXmdLwdgTYVfxeOgg&1300974183&EmbedId=1300974183
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
content-encoding: gzip
last-modified: Mon, 01 Apr 2019 18:07:07 GMT
server: Apache
etag: "177-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: max-age=604800
accept-ranges: bytes
content-length: 200
expires: Mon, 02 May 2022 14:47:24 GMT

GET
H2 200 config.js Show response
app.groove.cm/config/ Frame 2205 324 B
490 B 42ms
42ms Script
application/javascript 2a06:98c1:3120::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app.groove.cm/config/config.js
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5d7560c8b33f798d429fa0e84d88e11aff034ec7ab72a758d3ed52fc9b285a18

Request headers

Referer
Origin: https://app.groove.cm
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 25 Apr 2022 13:50:12 GMT
server: cloudflare
age: 3235
etag: W/"6266a714-144"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3Px%2Byftr8GK2JgIhp6MQtNHjTv5skcVVp1U8d89YWIinO%2BXvSgihcUjSKPwujU4MIjN2Vx3EqrkpgIbbXPROI2eABMsGdG87zEhvQtnfhlah934pbZ1E%2FdfYIls1sbjApd25Yb%2BB71D3k4PP"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7017dfa6ab15925c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 ae6893d8-cd70-4474-b00c-3812c0a0d4ab Show response
pp.signalayer.com/ Frame 2205 2 B
260 B 443ms
121ms Fetch
text/plain 34.232.251.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pp.signalayer.com/ae6893d8-cd70-4474-b00c-3812c0a0d4ab
Requested by: Host: cdn.tooltip.io
URL: https://cdn.tooltip.io/static/player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.251.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-251-165.compute-1.amazonaws.com
Software: nginx/1.15.8 / Express
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: application/json, application/xml, text/play, text/html, *.*
Referer: https://app.groove.cm/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
server: nginx/1.15.8
x-powered-by: Express
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Content-Type,Authorization
content-length: 2

GET
H2 200 ae6893d8-cd70-4474-b00c-3812c0a0d4ab.json Show response
data.tooltip.io/player/fetch/ Frame 2205 54 B
501 B 503ms
403ms Fetch
application/json 2600:9000:206f:7800:6:36e8:9f00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://data.tooltip.io/player/fetch/ae6893d8-cd70-4474-b00c-3812c0a0d4ab.json
Requested by: Host: cdn.tooltip.io
URL: https://cdn.tooltip.io/static/player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:7800:6:36e8:9f00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4e099629cd81ad69ae59437b8d17f8c059695cc385f1493af5f3a6cce4c994f7

Request headers

Accept: application/json, application/xml, text/play, text/html, *.*
Referer: https://app.groove.cm/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:25 GMT
via: 1.1 9570c3a1725c20e6faed117bbb74223a.cloudfront.net (CloudFront)
last-modified: Tue, 22 Mar 2022 08:42:52 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
etag: "21c5d7ac3026c86f166a0e24b12b2b5d"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
access-control-max-age: 3000
x-cache: RefreshHit from cloudfront
accept-ranges: bytes
content-length: 54
x-amz-cf-id: 9qnQsmvuSYCPg-x1kpbGWR5vCuVC160bGCpE6ipDi-T98bi9sgNopA==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 2205 180 KB
66 KB 181ms
83ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-VQKC5VQTH1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fb85fd71f83ed28e90ba1fa593ddd510122b4c525c34536c1e8016ba06b7658d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67870
x-xss-protection: 0
expires: Mon, 25 Apr 2022 14:47:24 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 2205 49 KB
20 KB 176ms
64ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 1813
date: Mon, 25 Apr 2022 14:17:11 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 25 Apr 2022 16:17:11 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame 2205 39 KB
15 KB 175ms
78ms Script
text/javascript 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

b9dff679ff9931afbbb8019d522a7d03d7787a7d7818037d48f3a502c652e2b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14892
x-xss-protection: 0
server: cafe
etag: 4605403730725282575
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 25 Apr 2022 14:47:24 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ Frame 2205 15 KB
6 KB 181ms
68ms Script
application/javascript 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

10354e9bc6b485028971a1f58fccff5c89d722db324d42bc07963aab24ebb956

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Mon, 25 Apr 2022 14:09:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2271
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 5748
x-amz-id-2: palgXfliLUZuNCLBVtrThCu7T5HOdd/Ln4zBxn2cpEUBZep6rHRmrK9BvawanEpP9+lDgK8ixNQ=
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 22 Feb 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 17 Jan 2022 12:00:39 GMT
server: ATS
etag: "13a189bb8f25228852b3279db3659c28-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: D2CR2YAEAGQNMX8H
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
x-amz-version-id: pAIvW1wzOXi43b8v53GVflu.j8ZqoXS3
accept-ranges: bytes
content-type: application/javascript

GET
H2 200 bat.js Show response
bat.bing.com/ Frame 2205 38 KB
12 KB 93ms
44ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Wed, 09 Feb 2022 23:54:49 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 497B05DE676E4EF3B8914F0D93BC2CA1 Ref B: FRAEDGE1515 Ref C: 2022-04-25T14:47:24Z
etag: "806a236c101ed81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
date: Mon, 25 Apr 2022 14:47:23 GMT
accept-ranges: bytes
content-length: 11333

GET
H2 200 ld.js Show response
static.criteo.net/js/ld/ Frame 2205 40 KB
13 KB 136ms
38ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/ld.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MKWM7K2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

e17cc900f2c3e8e09d3a2d454c231fccc85c4d1c6164b05c1d5c482a51d21190

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
content-encoding: gzip
last-modified: Wed, 30 Mar 2022 22:51:55 GMT
server: nginx
etag: W/"6244df0b-a0be"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Tue, 26 Apr 2022 14:47:24 GMT

GET
H2 200 universal-script Show response
175592.tracking.hyros.com/v1/lst/ Frame 2205 0
170 B 418ms
129ms Script
text/plain 18.210.240.141
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://175592.tracking.hyros.com/v1/lst/universal-script?ph=8d32ccb64bc3b013ad08e3b3db8b5c12f7094658f7a1802e1282fdafe6b1af24&tag=!tracking
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.210.240.141 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-18-210-240-141.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
access-control-allow-credentials: true
content-length: 0
access-control-max-age: 86400
access-control-allow-methods: GET, PUT, POST, OPTIONS, DELETE
access-control-expose-headers: Session-ID

OPTIONS
H3 204 fetch-with-permalink
v1.gdapis.com/api/groovevideo/ Frame 0
0 378ms
344ms Preflight
text/html 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=u1kHEnHT9wSJ2kyJJs0e&id=75215
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: x-auth-provider
Access-Control-Request-Method: GET
Origin: https://app.groove.cm
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-headers: Content-Type, X-Auth-Token, Origin, Authorization, *
access-control-allow-methods: POST, GET, OPTIONS, PUT, PATCH, DELETE
access-control-allow-origin: *
access-control-max-age: 86400
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 7017dfa7489f9b9a-FRA
content-type: text/html; charset=UTF-8
date: Mon, 25 Apr 2022 14:47:24 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P7Df9secwFtxrt0rP0qmodMRpEjlhdqAFX%2BzXZtcrS68jfRYVFXHnwiZ10LpE6r4d3pb0ZKEVrk%2BWCSCxbXGClbPJFNl1yUFJYPy1CDcFzbeWAHUM0CkVSC3ysmmXb62E9WbTfNu68GJHc7d"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/7.3.24

GET
H3 200 fetch-with-permalink Show response
v1.gdapis.com/api/groovevideo/ Frame 2205 2 KB
2 KB 158ms
158ms XHR
application/json 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.gdapis.com/api/groovevideo/fetch-with-permalink?permalink=u1kHEnHT9wSJ2kyJJs0e&id=75215
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/js/chunk-vendors.fc86ae3f.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.24
Resource Hash: 102390511cfad271d89b358aaa0eb8ee7abab2b7361fa95c724889d57850322c

Request headers

Accept: application/json, text/plain, */*
Referer: https://app.groove.cm/
x-auth-provider: auth0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-powered-by: PHP/7.3.24
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining: 599
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xg6LTRqc4e1w%2BE%2BaOYJKOo9yZCDfcnzyF2Mh7bJ5L6SxW26jgZVzslYHpfPdQ%2BQY7bMwIgiS1Go%2FihwfcsFKmuNAYh5H361dnXIfYhGN11utKTuGny7LAkjbgt47YPMcc6kboApxYq0WIbz2"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma
cache-control: no-cache, private
x-ratelimit-limit: 600
cf-ray: 7017dfa97d759b9a-FRA

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/534c466c/www-widgetapi.vflset/ Frame 2205 154 KB
50 KB 181ms
64ms Script
text/javascript 2a00:1450:4001:801::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/534c466c/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3dbb3a8aca8718efa36ff5141a017278211f64ffacbc876a92c8593765cacbff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:23:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1442
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50976
x-xss-protection: 0
last-modified: Thu, 21 Apr 2022 00:15:59 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Tue, 25 Apr 2023 14:23:22 GMT

GET
H2 200 17533112.js Show response
bat.bing.com/p/action/ Frame 2205 845 B
843 B 194ms
194ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/17533112.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6d50c567ed88aa1b2fb780460c18cb842669611508d308c7d9e9388b334c909d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 88EFB5E0B33F4D9E81E1064BD39AC9E7 Ref B: FRAEDGE1515 Ref C: 2022-04-25T14:47:24Z
date: Mon, 25 Apr 2022 14:47:23 GMT
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 666

GET
H2 204 0
bat.bing.com/action/ Frame 2205 0
175 B 53ms
53ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=17533112&Ver=2&mid=e15d83ad-3780-4268-8e69-2c7a173149a3&sid=9e464230c4a611eca033f96cf048caed&vid=9e469ed0c4a611ec877a47014ba26a85&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Groovevideo%20%C2%B7%20Groovevideo&p=https%3A%2F%2Femployeetaxrefund.com%2F&r=&lt=1268&evt=pageLoad&ifm=1&msclkid=N&sv=1&rn=324816

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CFAB713B8BA6476A9FC2A6E52132E6FF Ref B: FRAEDGE1515 Ref C: 2022-04-25T14:47:24Z
date: Mon, 25 Apr 2022 14:47:23 GMT
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 matomo.php
matomo.groovetech.io/ Frame 2205 0
523 B 96ms
95ms Ping
text/plain 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.php?action_name=Groovevideo%20%C2%B7%20Groovevideo&idsite=5&rec=1&r=353517&h=14&m=47&s=24&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&urlref=https%3A%2F%2Femployeetaxrefund.com%2F&_id=cce8463cadb47573&_idn=1&_refts=1650898044&_ref=https%3A%2F%2Femployeetaxrefund.com%2F&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=r4q3AO&pf_net=0&pf_srv=200&pf_tfr=1&pf_dm1=948
Requested by: Host: matomo.groovetech.io
URL: https://matomo.groovetech.io/matomo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://app.groove.cm/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.0.17
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fUTpQhIGAt6gmYHjiNLXZO6dID03OcUpUzXMYJds2GwAvDNcHjq6wreMDT%2F31TTiCAwftyxdUKfu%2BTZ04KwxG8zcQzifq3Vh0nnhjz0yvV9B24B9UxicbSiUh88euK1PdXnfw14uC7EIQuWvJ%2BKRW8iPRA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://app.groove.cm
access-control-allow-credentials: true
cf-ray: 7017dfa78b9d9b8e-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 3E40 13 KB
5 KB 120ms
48ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?topUrl=employeetaxrefund.com&origin=onetag

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/ld.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

2d97ecc3fc54beb500cfdfaab6e611f49e22c5dbaf368ede1c612e50bfd5099f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://app.groove.cm/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-length: 5136
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 25 Apr 2022 14:47:23 GMT
server-processing-duration-in-ticks: 2030
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/ Frame 2205 2 KB
2 KB 222ms
76ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/646915355/?random=1650898044152&cv=9&fst=1650898044152&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg4k0&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Femployeetaxrefund.com%2F&tiba=Groovevideo%20%C2%B7%20Groovevideo&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0e586d1a0a78ea724d41da0cdff0346245344d3aebf9e61d575e3515a8aa807

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1063
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 10139345.json Show response
s.yimg.com/wi/config/ Frame 2205 2 B
450 B 227ms
75ms XHR
application/json 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10139345.json

Requested by

Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:00:41 GMT
x-content-type-options: nosniff
age: 2803
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
x-amz-request-id: QXGYZE8NJFSXSNHN
x-amz-id-2: SJ9oBuPtCxlqMuuEUfMlG3i7oQ7AmRmaCtPHYGpQrfsdfcoJ4ShFlBfsE5XfHMQI5JOQWxF5sTc=
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
x-xss-protection: 1; mode=block
cache-control: public,max-age=3600
content-length: 2

GET
H2 200 clarity.js Show response
i.clarity.ms/s/0.6.34/ Frame 2205 53 KB
23 KB 367ms
98ms Script
application/javascript 52.167.85.21
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clarity.ms/s/0.6.34/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/17533112.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.167.85.21 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: br
etag: "1d84ac37b962954"
last-modified: Thu, 07 Apr 2022 21:07:26 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

GET
H2

200

sid Show response
mug.criteo.com/ Frame 3E40
Redirect Chain

https://gum.criteo.com/sid/json?origin=onetag&domain=app.groove.cm&sn=ChromeSyncframe&so=0&topUrl=employeetaxrefund.com&lsw=1
https://mug.criteo.com/sid?cpp=brd2knxsZkVEOGpOVnZsN0hBR3VRQWZxWWVLR0p6RDlnN1dFbWxlVXBmN0p4Y1RoT0dqOGRzUXIrODhYcGcrWVFuY2ttMis1U2FWQTNWSGpYa3VZYW1BdWM2L1RyckVUQkVzSmdlU3pmdTJOb3hyZDJwQTJ1Z0NMZlNqQU...

452 B
652 B

252ms
19ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=brd2knxsZkVEOGpOVnZsN0hBR3VRQWZxWWVLR0p6RDlnN1dFbWxlVXBmN0p4Y1RoT0dqOGRzUXIrODhYcGcrWVFuY2ttMis1U2FWQTNWSGpYa3VZYW1BdWM2L1RyckVUQkVzSmdlU3pmdTJOb3hyZDJwQTJ1Z0NMZlNqQUxXSjJsN25sL0VVbkR2WkJxbHN0UndNRzBlQmpQM05iVGMzdVNLZkN5NS9HbmFZZ2VqTTRHV3hnZXpTYWQ3cW1qNW9oYmZPVDJkT0ZpVU1WMkNMYmhuWDR3MExVUHdEMzI1QlRqeHBiTTFreW1PVnptOVhnMnJVN3Vpc2ZVSjJDUno0TndjajJxbVZGblJ5YlBPc0JxTi9mTERSVmxOcGRWYy9lM0EvdzNhcmZ4a01HbjRhTT18&cppv=2

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

920a7ef190e90b9a9de83b62bd36c4556d490ef464e60f874996d6c2e4cf7764

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:23 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 5364
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:23 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=brd2knxsZkVEOGpOVnZsN0hBR3VRQWZxWWVLR0p6RDlnN1dFbWxlVXBmN0p4Y1RoT0dqOGRzUXIrODhYcGcrWVFuY2ttMis1U2FWQTNWSGpYa3VZYW1BdWM2L1RyckVUQkVzSmdlU3pmdTJOb3hyZDJwQTJ1Z0NMZlNqQUxXSjJsN25sL0VVbkR2WkJxbHN0UndNRzBlQmpQM05iVGMzdVNLZkN5NS9HbmFZZ2VqTTRHV3hnZXpTYWQ3cW1qNW9oYmZPVDJkT0ZpVU1WMkNMYmhuWDR3MExVUHdEMzI1QlRqeHBiTTFreW1PVnptOVhnMnJVN3Vpc2ZVSjJDUno0TndjajJxbVZGblJ5YlBPc0JxTi9mTERSVmxOcGRWYy9lM0EvdzNhcmZ4a01HbjRhTT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1716
content-length: 567
expires: 0

GET
H3 200 0dTEPzkLWceF7z0koJaX1A.woff2
fonts.gstatic.com/s/raleway/v22/ Frame F0AF 46 KB
46 KB 58ms
58ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v22/0dTEPzkLWceF7z0koJaX1A.woff2

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/include/form/fonts8.css?1531236272143

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fs22.formsite.com/
Origin: https://fs22.formsite.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 20:42:47 GMT
x-content-type-options: nosniff
age: 497077
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47312
x-xss-protection: 0
last-modified: Tue, 29 Jun 2021 19:40:31 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 19 Apr 2023 20:42:47 GMT

GET
H3 200 zOdksD_UUTk1LJF9z4tURA.woff2
fonts.gstatic.com/s/cinzel/v12/ Frame F0AF 24 KB
24 KB 70ms
70ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/cinzel/v12/zOdksD_UUTk1LJF9z4tURA.woff2

Requested by

Host: fs22.formsite.com
URL: https://fs22.formsite.com/include/form/fonts8.css?1531236272143

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

304cbbc575c227a24f183d9800167ab06418327356f73099404136d8bb9a6c92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fs22.formsite.com/
Origin: https://fs22.formsite.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 02:28:34 GMT
x-content-type-options: nosniff
age: 476330
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24996
x-xss-protection: 0
last-modified: Tue, 04 May 2021 22:35:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 20 Apr 2023 02:28:34 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/646915355/ Frame 2205 42 B
548 B 170ms
55ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/646915355/?random=1650898044152&cv=9&fst=1650895200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg4k0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Femployeetaxrefund.com%2F&tiba=Groovevideo%20%C2%B7%20Groovevideo&async=1&fmt=3&is_vtc=1&random=777381326&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/646915355/ Frame 2205 42 B
548 B 169ms
50ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/646915355/?random=1650898044152&cv=9&fst=1650895200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg4k0&sendb=1&frm=2&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&ref=https%3A%2F%2Femployeetaxrefund.com%2F&tiba=Groovevideo%20%C2%B7%20Groovevideo&async=1&fmt=3&is_vtc=1&random=777381326&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:24 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ Frame 2205 43 B
632 B 192ms
62ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Mon%2C%2025%20Apr%202022%2014%3A47%3A24%20GMT&n=0&b=Groovevideo%20%C2%B7%20Groovevideo&.yp=10139345&f=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&e=https%3A%2F%2Femployeetaxrefund.com%2F&enc=UTF-8&yv=1.12.0&isIframe=1&tagmgr=gtm

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:24 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Mon, 25 Apr 2022 14:47:24 GMT

GET
H2 206 groovevideo-213d95e6b4b4fcf88270eebb4d673595.mp4
videos.groovevideo.com/5dd590f1c586100f1285ee7a/ Frame 2205 3 MB
3 MB 60ms
33ms Media
video/mp4 2600:9000:2315:5400:b:d801:7900:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://videos.groovevideo.com/5dd590f1c586100f1285ee7a/groovevideo-213d95e6b4b4fcf88270eebb4d673595.mp4
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2315:5400:b:d801:7900:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 56d3bf72133f30f5e4ea2824f5906c580070865a0355d83013bc22d1849d8e42

Request headers

Referer: https://app.groove.cm/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 25 Apr 2022 02:36:23 GMT
via: 1.1 ba922c695b86542cbfc03c782d8776d4.cloudfront.net (CloudFront)
last-modified: Fri, 12 Nov 2021 21:33:10 GMT
server: AmazonS3
age: 43862
etag: "f0a1f3fafedb3b07b52afe73134ecc80"
x-cache: Hit from cloudfront
content-type: video/mp4
Content-Range: bytes 0-2626605/2626606
x-amz-cf-pop: DUS51-P2
accept-ranges: bytes
Content-Length: 2626606
x-amz-cf-id: 31knjGOu-aLOknAx5JpLZPxWrMlecukxNhjl0Ox_mliJ-PlxnZrWyQ==

GET
H2

200

event Show response
widget.us.criteo.com/ Frame 2205
Redirect Chain

https://sslwidget.criteo.com/event?a=81296&v=5.9.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeetaxrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=r-vNE19NWTRNbHRURnc3Rm9...
https://widget.us.criteo.com/event?a=81296&v=5.9.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeetaxrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=r-vNE19NWTRNbHRURnc3Rm9...

8 KB
8 KB

428ms
137ms

Script
application/x-javascript

74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://widget.us.criteo.com/event?a=81296&v=5.9.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeetaxrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=r-vNE19NWTRNbHRURnc3Rm9NdGVPQWUlMkJMSlBwYmdBclFOdzZzenV3VkQwSEpTRlZ4UWQlMkJKZVhCVHJCemNqeEtOcmlLOU96SlhyWUQlMkZwNnk0N1dZTEtIU1QyWVJoYm90b3RDYWZGOXd3Tk1kckcwV0Q5cXlkdnBPb282Nk5rZVBwTmd2SUlLc3ZFeVBUUWhIMU5Zb2dHQnJ4cXRkM0tJbGhUeUozWE9uQzBCc09WSW8lM0Q&tld=app.groove.cm&fu=https%3A%2F%2Femployeetaxrefund.com&dtycbr=76774

Requested by

Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e

Protocol

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

7d912a263857902d3ebb8ef4a4639ff2c758379fc1c64cb63622081a6402efb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:25 GMT
content-type: application/x-javascript
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 11418907
timing-allow-origin: *
expires: 0

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:23 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
location: https://widget.us.criteo.com/event?a=81296&v=5.9.0&p0=e%3Dexd%26site_type%3Dd%26ref%3Dhttps%253A%252F%252Femployeetaxrefund.com&p1=e%3Dvh&p2=e%3Dvp%26p%3D1&p3=e%3Ddis&bundle=r-vNE19NWTRNbHRURnc3Rm9NdGVPQWUlMkJMSlBwYmdBclFOdzZzenV3VkQwSEpTRlZ4UWQlMkJKZVhCVHJCemNqeEtOcmlLOU96SlhyWUQlMkZwNnk0N1dZTEtIU1QyWVJoYm90b3RDYWZGOXd3Tk1kckcwV0Q5cXlkdnBPb282Nk5rZVBwTmd2SUlLc3ZFeVBUUWhIMU5Zb2dHQnJ4cXRkM0tJbGhUeUozWE9uQzBCc09WSW8lM0Q&tld=app.groove.cm&fu=https%3A%2F%2Femployeetaxrefund.com&dtycbr=76774
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2054188
timing-allow-origin: *
content-length: 0
expires: 0

POST
H2 204 collect Show response
i.clarity.ms/ Frame 2205 0
91 B 321ms
321ms XHR
text/plain 52.167.85.21
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clarity.ms/collect
Requested by: Host: i.clarity.ms
URL: https://i.clarity.ms/s/0.6.34/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.167.85.21 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://app.groove.cm/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin: https://app.groove.cm
date: Mon, 25 Apr 2022 14:47:24 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

POST
H3 204 matomo.php
matomo.groovetech.io/ Frame 2205 0
527 B 156ms
156ms Ping
text/plain 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.groovetech.io/matomo.php?action_name=Groovevideo%20%C2%B7%20Groovevideo&idsite=5&rec=1&r=007377&h=14&m=47&s=24&url=https%3A%2F%2Fapp.groove.cm%2Fgroovevideo%2Fvideo%2F75215%2Fu1kHEnHT9wSJ2kyJJs0e&urlref=https%3A%2F%2Femployeetaxrefund.com%2F&_id=5551edb2f40ed4c2&_idn=1&_refts=1650898045&_ref=https%3A%2F%2Femployeetaxrefund.com%2F&send_image=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=u2TAW7&pf_net=0&pf_srv=200&pf_tfr=1&pf_dm1=948
Requested by: Host: matomo.groovetech.io
URL: https://matomo.groovetech.io/matomo.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.17
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://app.groove.cm/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Mon, 25 Apr 2022 14:47:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: PHP/8.0.17
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i0HlcOTZZ57ndODUzpJsyitldUoOdwSC3k8fKXZE%2F1Bt97ivdk1j7HU%2BaXqsxskf9Ky34ojBUHJgyBGge%2FH6PO4XNhyxGWAUtoqpxDbbeynCVnSHdLKoNWkKeptMmfVkWJvZkItOhQrnv1XL%2B8%2F9ZEiBGw%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://app.groove.cm
access-control-allow-credentials: true
cf-ray: 7017dfacbf1d9b8e-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 / Show response
beacon-v2.helpscout.net/ Frame 2205 293 B
618 B 109ms
36ms Script
application/javascript 108.157.4.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/
Requested by: Host: app.groove.cm
URL: https://app.groove.cm/groovevideo/video/75215/u1kHEnHT9wSJ2kyJJs0e
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-72.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 401594c12a9f4a898ff4d54a395e0947d40c7dfc5fc27990661318509dfe80db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:46:53 GMT
content-encoding: gzip
last-modified: Thu, 14 Apr 2022 12:04:51 GMT
server: AmazonS3
age: 35
etag: "bb0cd56b1ba86a919de09bdbc62f60b5"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 b0067143f1e1520182fe27b53cced2a6.cloudfront.net (CloudFront)
cache-control: max-age=120, s-maxage=120, public
x-amz-cf-pop: DUS51-P2
accept-ranges: bytes
content-length: 244
x-amz-cf-id: gzYxhGn2Wp1urFPUcthl6c5pir1eR3dedbIhCW1sxwMNuso8RDBK9g==

GET
H2

200

c.gif
c.clarity.ms/ Frame 2205
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=81EC3FD81A16468393FC8283A8FCD104&RedC=c.clarity.ms&MXFR=0076B5267B2263E23D12A4B77F226D6A
https://c.clarity.ms/c.gif?CtsSyncId=81EC3FD81A16468393FC8283A8FCD104&MUID=1E0E39A21080653414A6283311EB64C5

42 B
368 B

66ms
66ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=81EC3FD81A16468393FC8283A8FCD104&MUID=1E0E39A21080653414A6283311EB64C5
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:24 GMT
last-modified: Fri, 18 Mar 2022 19:39:54 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "8120eaf0ff3ad81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:24 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2B1FDAF72F0A450C918E2C0F7C42737D Ref B: FRAEDGE1515 Ref C: 2022-04-25T14:47:25Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=81EC3FD81A16468393FC8283A8FCD104&MUID=1E0E39A21080653414A6283311EB64C5
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2

200

397596.gif
idsync.rlcdn.com/ Frame 7848
Redirect Chain

https://gum.criteo.com/sync?c=6&r=1&k=1&a=1&u=https%3A%2F%2Fidsync.rlcdn.com%2F397596.gif%3Fpartner_uid%3D%40USERID%40
https://idsync.rlcdn.com/397596.gif?partner_uid=v9Y2MAbWefjtno3OMCa5lU9wu5evI8WI

42 B
178 B

126ms
53ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/397596.gif?partner_uid=v9Y2MAbWefjtno3OMCa5lU9wu5evI8WI
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 14:47:25 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

location: https://idsync.rlcdn.com/397596.gif?partner_uid=v9Y2MAbWefjtno3OMCa5lU9wu5evI8WI
date: Mon, 25 Apr 2022 14:47:24 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2505
content-length: 197
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 7848
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&google_hm=ay1NWUN0TUpUZjFZU1F3U0ZDM0R5WTg1eXBBbk1MQXUxX2l6TE9HQQ
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

43 B
369 B

414ms
65ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Server

178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:25 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 308001
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:25 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&google_ula=913071,0
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 279
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
NO CONTENT /
partner.mediawallahscript.com/ Frame 7848 0
232 B 249ms
68ms Image
text/html 54.73.16.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.mediawallahscript.com/?account_id=1043&partner_id=1048&uid=k-MYCtMJTf1YSQwSFC3DyY85ypAnMLAu1_izLOGA&custom=&tag_format=img&tag_action=sync&custom=&cb=13843c9e-c62e-471f-8b45-ee9b0c08f6b3
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.73.16.64 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-73-16-64.eu-west-1.compute.amazonaws.com
Software: nginx/1.20.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 14:47:25 GMT
Cache-Control: no-cache, no-store, must-revalidate
Expires: 0
Server: nginx/1.20.0
Connection: keep-alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 362338.gif
idsync.rlcdn.com/ Frame 7848 42 B
447 B 161ms
52ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362338.gif?partner_uid=k-MYCtMJTf1YSQwSFC3DyY85ypAnMLAu1_izLOGA
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 25 Apr 2022 14:47:25 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 204 v1
ads.yahoo.com/cms/ Frame 7848 0
47 B 234ms
83ms Image
text/plain 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~7315a025058f3128185459bfaf16e164414683fc&nwid=10000545908&sigv=1

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:25 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

GET
H2 200 spp.pl
sp.analytics.yahoo.com/ Frame 7848 43 B
291 B 91ms
87ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10001287818027&.yp=10028862&js=no

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:25 GMT
x-content-type-options: nosniff
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-length: 43
referrer-policy: strict-origin-when-cross-origin
expires: Mon, 25 Apr 2022 14:47:25 GMT

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58301/ Frame 7848 0
480 B 151ms
35ms Image
text/plain 3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-qF4a0pTf1YSQwSFC3DyY85ypAnOjZRhgUVMo5Q

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.0.46 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:25 GMT
server: ATS/9.1.0.46
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1 200
OK cookie-sync
sync.outbrain.com/ Frame 7848 0
476 B 518ms
140ms Image
text/plain 70.42.32.95
INTERNAP-BLK3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-4IszrZTf1YSQwSFC3DyY85ypAnPQzsUP2A72ww
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.95 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date: Mon, 25 Apr 2022 14:47:25 GMT
Cache-Control: no-cache
X-TraceId: a8cffe2567ba7452de44e98754a14ddd
Content-Length: 0

GET
H2 204 t.gif
cw.addthis.com/ Frame 7848 0
427 B 1191ms
256ms Image
text/plain 184.30.24.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cw.addthis.com/t.gif?pid=113&pdid=k-nl-akZTf1YSQwSFC3DyY85ypAnPSTkASciYz4A
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.24.121 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-121.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:26 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 25 Apr 2022 14:47:26 GMT

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame 7848 0
239 B 198ms
49ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-nl-akZTf1YSQwSFC3DyY85ypAnPSTkASciYz4A&expires=30
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Content-Type: image/gif

GET
H/1.1

200
OK

bounce
secure.adnxs.com/ Frame 7848
Redirect Chain

https://secure.adnxs.com/setuid?entity=52&code=k-92Ol9ZTf1YSQwSFC3DyY85ypAnPPCIhLtK3Tyg&seg=95287
https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-92Ol9ZTf1YSQwSFC3DyY85ypAnPPCIhLtK3Tyg%26seg%3D95287

43 B
1 KB

26ms
26ms

Image
image/gif

37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-92Ol9ZTf1YSQwSFC3DyY85ypAnPPCIhLtK3Tyg%26seg%3D95287

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

HTTP/1.1

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 14:47:25 GMT
X-Proxy-Origin: 185.213.155.165; 185.213.155.165; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: feae189e-e8cc-4331-9dec-9841ecd7f845
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 14:47:25 GMT
X-Proxy-Origin: 185.213.155.165; 185.213.155.165; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 4f622676-eba7-4654-b278-2f6abaac9ce8
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-92Ol9ZTf1YSQwSFC3DyY85ypAnPPCIhLtK3Tyg%26seg%3D95287
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 7848
Redirect Chain

https://ib.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fib.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
https://ib.adnxs.com/bounce?%2Fseg%3Fadd%3D95287%26redir%3Dhttps%253A%252F%252Fib.adnxs.com%252Fgetuid%253Fhttps%253A%252F%252Fdis.criteo.com%252Fdis%252Frtb%252Fappnexus%252Fcookiematch.aspx%253Fa...
https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1268435024720673585

43 B
370 B

170ms
76ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1268435024720673585

Protocol

Server

178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:25 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 6299528
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 14:47:25 GMT
X-Proxy-Origin: 185.213.155.165; 185.213.155.165; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2d087262-e2a3-45cd-aa40-c1efdb0c5ce2
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1268435024720673585
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 Pug
simage2.pubmatic.com/AdServer/ Frame 7848 42 B
681 B 512ms
73ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-17qIZJTf1YSQwSFC3DyY85ypAnNwCumYaNQuDw
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:25 GMT
cache-control: no-store, no-cache, private
x-lat: lhrpug010:0:499
server: nginx
content-type: image/gif; charset=utf-8
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

xuid
eb2.3lift.com/ Frame 7848
Redirect Chain

https://eb2.3lift.com/xuid?mid=2711&xuid=k-cC-OypTf1YSQwSFC3DyY85ypAnMsSXZ80IXC0Q&dongle=013b
https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-cC-OypTf1YSQwSFC3DyY85ypAnMsSXZ80IXC0Q&dongle=013b&gdpr=1&cmp_cs=&us_privacy=

37 B
354 B

62ms
61ms

Image
image/gif

13.248.245.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=2711&xuid=k-cC-OypTf1YSQwSFC3DyY85ypAnMsSXZ80IXC0Q&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
Protocol: H2
Server: 13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a0f671730127a0812.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=2711&xuid=k-cC-OypTf1YSQwSFC3DyY85ypAnMsSXZ80IXC0Q&dongle=013b&gdpr=1&cmp_cs=&us_privacy=
date: Mon, 25 Apr 2022 14:47:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 cksync.php
contextual.media.net/ Frame 7848 45 B
786 B 246ms
76ms Image
image/gif 104.90.192.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k--GS-SJTf1YSQwSFC3DyY85ypAnOwunNAJPdBZg

Requested by

Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.90.192.189 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-90-192-189.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=604800
server: Apache
date: Mon, 25 Apr 2022 14:47:25 GMT
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
cache-control: max-age=0, no-cache, no-store
content-type: image/gif
content-length: 45
x-mnet-hl2: E
expires: Mon, 25 Apr 2022 14:47:25 GMT

GET
H/1.1

200
OK

rum
r.casalemedia.com/ Frame 7848
Redirect Chain

https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-HifI05Tf1YSQwSFC3DyY85ypAnP5vYkiWVv8rA
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-HifI05Tf1YSQwSFC3DyY85ypAnP5vYkiWVv8rA&C=1

43 B
1 KB

124ms
124ms

Image
image/gif

2.20.85.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-HifI05Tf1YSQwSFC3DyY85ypAnP5vYkiWVv8rA&C=1
Protocol: HTTP/1.1
Server: 2.20.85.164 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-85-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 14:47:26 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 25 Apr 2022 14:47:26 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 14:47:25 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-HifI05Tf1YSQwSFC3DyY85ypAnP5vYkiWVv8rA&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 296
Expires: Mon, 25 Apr 2022 14:47:25 GMT

GET
H2 204 /
s.ad.smaato.net/c/ Frame 7848 0
239 B 420ms
67ms Image
text/plain 2600:9000:2057:aa00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?dspInit=1001851&dspCookie=k-BmBpw5Tf1YSQwSFC3DyY85ypAnNINGwkPIfrfQ
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:aa00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:25 GMT
via: 1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront)
server: CloudFront
cache-control: no-cache, must-revalidate
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: moMF0TPhPYH6giVntwYs5GGvc8r9iStHdBThIvhM3I8jRjy0EX9O8w==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H/1.1

200
OK

sync
x.bidswitch.net/ul_cb/ Frame 7848
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=46&user_id=k-Oj7Q85Tf1YSQwSFC3DyY85ypAnM5zQCT5samXA&expires=30&user_group=5
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-Oj7Q85Tf1YSQwSFC3DyY85ypAnM5zQCT5samXA&expires=30&user_group=5

43 B
495 B

61ms
61ms

Image
image/gif

3.121.19.101
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-Oj7Q85Tf1YSQwSFC3DyY85ypAnM5zQCT5samXA&expires=30&user_group=5
Protocol: HTTP/1.1
Server: 3.121.19.101 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-19-101.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date: Mon, 25 Apr 2022 14:47:26 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

Location: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-Oj7Q85Tf1YSQwSFC3DyY85ypAnM5zQCT5samXA&expires=30&user_group=5
Date: Mon, 25 Apr 2022 14:47:26 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2 200 um
criteo-sync.teads.tv/ Frame 7848 23 B
172 B 922ms
87ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-sync.teads.tv/um?eid=80&uid=k-CX-pcJTf1YSQwSFC3DyY85ypAnOc6YVRdBxc4Q
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:26 GMT
cache-control: max-age=0, no-cache, no-store
expires: Mon, 25 Apr 2022 14:47:26 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H2 200 /
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 7848 0
99 B 424ms
75ms Image
text/plain 141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k--VvRFZTf1YSQwSFC3DyY85ypAnOWWIBzowcRcg
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:26 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 72181

GET
H/1.1 200
OK /
rtb-csync.smartadserver.com/redir/ Frame 7848 43 B
163 B 717ms
67ms Image
image/gif 185.86.137.133
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-Ekosq5Tf1YSQwSFC3DyY85ypAnNFynRrIp7MTQ
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.133 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:26 GMT
transfer-encoding: chunked
content-type: image/gif

GET
H2 200 v1
match.sharethrough.com/sync/ Frame 7848 68 B
263 B 944ms
60ms Image
image/png 3.120.83.85
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-Y176Z5Tf1YSQwSFC3DyY85ypAnM1AtoXmbNbKQ
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.120.83.85 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-120-83-85.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:26 GMT
content-length: 68
content-type: image/png

GET
H2

200

match
ad.360yield.com/ul_cb/ Frame 7848
Redirect Chain

https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-VRGOEZTf1YSQwSFC3DyY85ypAnMqfgTnCvs4gA
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-VRGOEZTf1YSQwSFC3DyY85ypAnMqfgTnCvs4gA

43 B
445 B

327ms
327ms

Image
image/gif

34.248.117.172
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-VRGOEZTf1YSQwSFC3DyY85ypAnMqfgTnCvs4gA
Protocol: H2
Server: 34.248.117.172 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-117-172.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin: *
date: Mon, 25 Apr 2022 14:47:26 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location: https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-VRGOEZTf1YSQwSFC3DyY85ypAnMqfgTnCvs4gA
date: Mon, 25 Apr 2022 14:47:26 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

28292
i6.liadm.com/s/ Frame 7848
Redirect Chain

https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-O-vctpTf1YSQwSFC3DyY85ypAnNr8P6LFwwKkw
https://i.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-O-vctpTf1YSQwSFC3DyY85ypAnNr8P6LFwwKkw&_li_chk=true&previous_uuid=bcb0a9ff0f7b4d498753e4bcdbdf1341
https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-O-vctpTf1YSQwSFC3DyY85ypAnNr8P6LFwwKkw

43 B
419 B

432ms
111ms

Image
image/gif

2600:1f18:444a:4680:27f9:539b:c9b0:d2ce
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-O-vctpTf1YSQwSFC3DyY85ypAnNr8P6LFwwKkw

Protocol

HTTP/1.1

Server

2600:1f18:444a:4680:27f9:539b:c9b0:d2ce Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date: Mon, 25 Apr 2022 14:47:27 GMT
Cache-Control: no-store
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Type: image/gif

Redirect headers

Location: https://i6.liadm.com/s/28292?bidder_id=71340&bidder_uuid=k-O-vctpTf1YSQwSFC3DyY85ypAnNr8P6LFwwKkw
Date: Mon, 25 Apr 2022 14:47:26 GMT
Connection: keep-alive
Content-Length: 0
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H2 200 1017
jadserve.postrelease.com/suid/ Frame 7848 43 B
428 B 433ms
155ms Image
image/gif 54.227.185.17
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://jadserve.postrelease.com/suid/1017?vk=k-obARh5Tf1YSQwSFC3DyY85ypAnN8UmiEehQJvQ
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.227.185.17 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-227-185-17.compute-1.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:26 GMT
server: nginx/1.12.1
p3p: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
content-length: 43
expires: Mon, 1 Jan 1990 12:00:00 GMT

GET
H2 200 sync
criteo-partners.tremorhub.com/ Frame 7848 43 B
183 B 580ms
165ms Image
image/gif 2600:1f18:612b:4216:25d9:1223:9f5d:e330
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://criteo-partners.tremorhub.com/sync?UICR=k-PSHvCpTf1YSQwSFC3DyY85ypAnMa0tYet8es_A
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4216:25d9:1223:9f5d:e330 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:26 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

GET
H/1.1

200
OK

empty.gif
cdn.stickyadstv.com/one-shot/ Frame 7848
Redirect Chain

https://ads.stickyadstv.com/user-registering?dataProviderId=434&userId=k-rwPfmpTf1YSQwSFC3DyY85ypAnPBUF_BLcZmhA&redirectId=69
https://cdn.stickyadstv.com/one-shot/empty.gif?

43 B
462 B

460ms
18ms

Image
image/gif

2001:4de0:ac19::1:b:1b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.stickyadstv.com/one-shot/empty.gif?
Protocol: HTTP/1.1
Server: 2001:4de0:ac19::1:b:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date: Mon, 25 Apr 2022 14:47:27 GMT
Last-Modified: Thu, 28 Feb 2013 15:45:35 GMT
ETag: "1362066335"
X-HW: 1650898047.dop004.am5.t,1650898047.cds318.am5.shn,1650898047.dop004.am5.t,1650898047.cds014.am5.c
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=7200
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 43

Redirect headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 14:47:26 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://cdn.stickyadstv.com/one-shot/empty.gif?
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1650898046165015-335
Expires: Mon, 25 Apr 2022 14:47:26 GMT

GET
H2 200 push
exchange.mediavine.com/usersync/ Frame 7848 40 B
40 B 461ms
177ms Image
text/html 3.124.27.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-EHffQJTf1YSQwSFC3DyY85ypAnOIb2EWY2abSQ
Requested by: Host: employeetaxrefund.com
URL: https://employeetaxrefund.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.27.94 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-27-94.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:47:26 GMT
cache-control: private, no-cache
access-control-allow-credentials: true
content-encoding: gzip
vary: Origin, Accept-Encoding
content-type: text/html; charset=utf-8

GET
H2 200 vendor.7a449b18.js Show response
beacon-v2.helpscout.net/static/js/ Frame 2205 699 KB
196 KB 33ms
32ms Script
application/javascript 108.157.4.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/static/js/vendor.7a449b18.js
Requested by: Host: beacon-v2.helpscout.net
URL: https://beacon-v2.helpscout.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-72.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 933d58802077f5ce49cd2b3c8706923d24bcb02651fab7964f7b583615ae44e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:05:29 GMT
content-encoding: gzip
last-modified: Thu, 14 Apr 2022 12:04:52 GMT
server: AmazonS3
age: 2516
etag: "9b4b96ced03efa7d68fe992b16158e07"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 b0067143f1e1520182fe27b53cced2a6.cloudfront.net (CloudFront)
cache-control: max-age=315360000, s-maxage=7200, public
x-amz-cf-pop: DUS51-P2
accept-ranges: bytes
content-length: 199876
x-amz-cf-id: 1Twq01jWX2DS_NPpDYkoqYDiiboUsXk3Z1GwtS46BGTQdfsYB3QDDw==

GET
H2 200 main.3fdc51dc.js Show response
beacon-v2.helpscout.net/static/js/ Frame 2205 268 KB
68 KB 117ms
117ms Script
application/javascript 108.157.4.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon-v2.helpscout.net/static/js/main.3fdc51dc.js
Requested by: Host: beacon-v2.helpscout.net
URL: https://beacon-v2.helpscout.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-72.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b375f9bd0355659321e5d71a79f29b1bd92c35983937a27aaa387e7b66b1fc2d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://app.groove.cm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date: Mon, 25 Apr 2022 14:05:08 GMT
content-encoding: gzip
last-modified: Thu, 14 Apr 2022 12:04:52 GMT
server: AmazonS3
age: 2538
etag: "dd359b17b061d20d4ce82c4d8a663c2e"
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 b0067143f1e1520182fe27b53cced2a6.cloudfront.net (CloudFront)
cache-control: max-age=315360000, s-maxage=7200, public
x-amz-cf-pop: DUS51-P2
accept-ranges: bytes
content-length: 68920
x-amz-cf-id: CxqyK0CEiofPk2Kqm06GGKRj-G7jYZwQVp6ZGjaXSviuvvLy_PdGoQ==

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/cdb/ Frame 7848
Redirect Chain

https://gum.criteo.com/sync?c=383&r=1&a=1&u=https%3A%2F%2Fd.turn.com%2Fr%2Fdd%2Fid%2FL2NzaWQvMS9jaWQvMTc0ODc0NDU2Ni90LzI%2Fdpuid%2F%40USERID%40%2Furl%2Fhttps%253A%252F%252Fdis.criteo.com%252Fdis%25...
https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMTc0ODc0NDU2Ni90LzI/dpuid/MVMPhITII7MZGKExRi24gFRzsyUq5j3_/url/https%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fcdb%2Fcookiematch.aspx%3F%26extid%3D%24!%7BTURN_...
https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=3755389855209047225

43 B
370 B

76ms
75ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=3755389855209047225

Protocol

Server

178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:25 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1719416
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://dis.criteo.com/dis/rtb/cdb/cookiematch.aspx?&extid=3755389855209047225
pragma: no-cache
date: Mon, 25 Apr 2022 14:47:25 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 7848
Redirect Chain

https://secure.adnxs.com/seg?add=95287&redir=https%3A%2F%2Fsecure.adnxs.com%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
https://secure.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1268435024720673585

43 B
370 B

71ms
71ms

Image
image/gif

178.250.2.151
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1268435024720673585

Protocol

Server

178.250.2.151 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 25 Apr 2022 14:47:26 GMT
content-type: image/gif
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1426635
timing-allow-origin: *
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 25 Apr 2022 14:47:26 GMT
X-Proxy-Origin: 185.213.155.165; 185.213.155.165; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: c753a596-3e27-464d-a001-a28909c51f36
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=1268435024720673585
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 collect Show response
i.clarity.ms/ Frame 2205 0
48 B 154ms
154ms XHR
text/plain 52.167.85.21
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clarity.ms/collect
Requested by: Host: i.clarity.ms
URL: https://i.clarity.ms/s/0.6.34/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.167.85.21 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://app.groove.cm/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin: https://app.groove.cm
date: Mon, 25 Apr 2022 14:47:25 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

Verdicts & Comments Add Verdict or Comment

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

56 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
fs22.formsite.com/res	1969-12-31 23:59:59	Name: JSESSIONID Value: BAACD7FA50AD5AEBAE732D683839F60B
i.liadm.com/s	1970-01-20 03:18:10	Name: _li_ss Value: MgkI_____wcQkRI
employeetaxrefund.com/	1970-01-20 12:00:53	Name: _pk_id.4.2f31 Value: c811363018246fdc.1650898042.
employeetaxrefund.com/	1970-01-20 02:34:59	Name: _pk_ses.4.2f31 Value: 1
.vimeo.com/	1970-01-20 02:34:59	Name: __cf_bm Value: ZXmNAKiO7YN_Wx73GrSomf5Hv26SeWeyLb.n1s4XjD8-1650898042-0-AbH9SZOhCLxEUQj3E4CtYyCqTQ2d2OWnW0YX8ysAmHUN6oRfpYEWn7ge1t61EwaeJXYMBBumUqxcskz/8pLjrb8=
employeetaxrefund.com/	1969-12-31 23:59:59	Name: hasVisitedPopupPage Value: true
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: WpPxPgrl6Lg
.youtube.com/	1970-01-20 06:54:10	Name: VISITOR_INFO1_LIVE Value: O7f-jP9s7wA
.bing.com/	1970-01-20 11:56:34	Name: MUID Value: 1E0E39A21080653414A6283311EB64C5
.criteo.com/	1970-01-20 11:56:34	Name: uid Value: 5e656bab-d674-4282-a585-d2dffa1f77cb
fs22.formsite.com/	1970-01-20 02:45:02	Name: AWSALBCORS Value: a3bXMXPhfGUBv4xUJU/bKY1ZHTIkyHzWFBkSzYQJwx6R4XfEtgecQzwJmW4sJDJxkJa1TMn2ZOf+l1R5qZag78ihtaZFhezdAJwXVcKmXHgLwR/seEB8V+RfuFFs
.yahoo.com/	1970-01-20 11:20:55	Name: A3 Value: d=AQABBHy0ZmICEGbOld17rklo4MG83a0PjHUFEgEBAQEFaGJwYgAAAAAA_eMAAA&S=AQAAAmluuKH3pUVM2Fz9qMbg2CU
.analytics.yahoo.com/	1970-01-20 11:20:34	Name: IDSYNC Value: 18zh~24j2
.rlcdn.com/	1970-01-20 11:20:34	Name: rlas3 Value: N73mUf/cka8L42cu/rT736x5l6cqeoTYRlJvtwd7KSA=
.rlcdn.com/	1970-01-20 04:01:22	Name: pxrc Value: CAA=
.doubleclick.net/	1970-01-20 11:56:34	Name: IDE Value: AHWqTUl9jQzFlo99yGwHza3n8f_6yTP-Zo2hNwgoHX1Y12vY6Qtf2mlzF-YpczlUe88
.c.bing.com/	1970-01-20 11:56:34	Name: SRM_B Value: 1E0E39A21080653414A6283311EB64C5
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 11:56:34	Name: MUID Value: 1E0E39A21080653414A6283311EB64C5
.c.clarity.ms/	1970-01-20 02:34:58	Name: ANONCHK Value: 0
.adnxs.com/	1970-01-20 04:44:34	Name: uuid2 Value: 1268435024720673585
.3lift.com/	1970-01-20 04:44:34	Name: tluid Value: 634085547814061351239
.media.net/	1970-01-20 11:20:34	Name: visitor-id Value: 2938996458397312000V10
.media.net/	1970-01-20 03:18:10	Name: data-c-ts Value: 1650898045
.media.net/	1970-01-20 03:18:10	Name: data-c Value: k--GS-SJTf1YSQwSFC3DyY85ypAnOwunNAJPdBZg~~3
.outbrain.com/	1970-01-20 04:44:34	Name: obuid Value: 586ec418-fe13-4eaa-b5ae-383927c66ded
.outbrain.com/	1970-01-20 03:03:46	Name: criteo Value: k-4IszrZTf1YSQwSFC3DyY85ypAnPQzsUP2A72ww
.pubmatic.com/	1970-01-20 03:18:10	Name: KRTBCOOKIE_97 Value: 3385-uid:k-17qIZJTf1YSQwSFC3DyY85ypAnNwCumYaNQuDw&KRTB&23144-uid:k-17qIZJTf1YSQwSFC3DyY85ypAnNwCumYaNQuDw&KRTB&23286-uid:k-17qIZJTf1YSQwSFC3DyY85ypAnNwCumYaNQuDw&KRTB&23287-uid:k-17qIZJTf1YSQwSFC3DyY85ypAnNwCumYaNQuDw
.pubmatic.com/	1970-01-20 03:18:10	Name: PugT Value: 1650898045
.pubmatic.com/	1970-01-20 04:44:34	Name: PUBMDCID Value: 3
.casalemedia.com/	1970-01-20 11:20:34	Name: CMID Value: Yma0fZJ4eDPURdOpWzB0hQAA
.casalemedia.com/	1970-01-20 04:44:34	Name: CMPS Value: 3270
.turn.com/	1970-01-20 06:54:10	Name: uid Value: 3755389855209047225
.casalemedia.com/	1970-01-20 04:44:34	Name: CMPRO Value: 1155
.casalemedia.com/	1970-01-20 02:36:24	Name: CMST Value: Yma0fWJmtH0A
.casalemedia.com/	1970-01-20 11:20:34	Name: CMRUM3 Value: 146266b47d2760k-HifI05Tf1YSQwSFC3DyY85ypAnP5vYkiWVv8rA
.bidswitch.net/	1970-01-20 11:20:34	Name: tuuid Value: c143e687-dfc2-4c8c-9e17-90639e9f8689
.bidswitch.net/	1970-01-20 11:20:34	Name: c Value: 1650898046
.bidswitch.net/	1970-01-20 11:20:34	Name: tuuid_lu Value: 1650898046
.360yield.com/	1970-01-20 04:44:34	Name: tuuid Value: c67eca3b-7a8c-415c-b3c1-e05a1e9ae031
.360yield.com/	1970-01-20 04:44:34	Name: tuuid_lu Value: 1650898046
.postrelease.com/	1970-01-20 11:20:34	Name: opt_out Value: 1
.addthis.com/	1970-01-20 11:56:34	Name: ouid Value: 6266b47e00015167374ad77c589fccdd273bbd22a56a351fdb71
.addthis.com/	1970-01-20 11:56:34	Name: uid Value: 6266b47e9770f26b
.addthis.com/	1970-01-20 11:56:34	Name: na_id Value: 2022042514472625200502663467
.360yield.com/	1970-01-20 04:44:34	Name: um Value: !38,MgXeDOOxfQaocnFrerw2Pk6MgFWCeW2hG-6kfA1shLW2sUsga7byPcXf1P84kTvVSQ7tnoAq,1658674046
.360yield.com/	1970-01-20 04:44:34	Name: umeh Value: !38,0,1713106046,-1
.adnxs.com/	1970-01-20 04:44:34	Name: anj Value: dTM7k!M4/rD>6NRF']wIg2In=nrv`)!fsuh'zDWNo5i@?nrTu!`8DM$_(F$b4U5dT21_tJ5Oq)^_sWY8I9N`vI?'RJ1Mk?.[H#0)viW/j5D8-@P)[Q]P)j.gQ[Twb
exchange.mediavine.com/	1970-01-20 02:55:07	Name: mv_tokens Value: %7B%22mv_uuid%22%3A%229fd25660-c4a6-11ec-9140-9738e0ce4c9e%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 02:55:07	Name: mv_tokens_eu-v1 Value: %7B%22mv_uuid%22%3A%229fd25660-c4a6-11ec-9140-9738e0ce4c9e%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/	1970-01-20 02:55:07	Name: criteo Value: %7B%22id%22%3A%22k-EHffQJTf1YSQwSFC3DyY85ypAnOIb2EWY2abSQ%22%2C%22version%22%3A%22criteo%22%7D
.sharethrough.com/	1970-01-20 03:18:10	Name: stx_user_id Value: 749999c3-737e-4750-9179-f71b86ba1964
.liadm.com/	1970-01-20 20:06:10	Name: lidid Value: bcb0a9ff-0f7b-4d49-8753-e4bcdbdf1341
ads.stickyadstv.com/	1970-01-20 03:18:10	Name: UID Value: 91a9d645338aaeafe6596d37b9518e
ads.stickyadstv.com/	1970-01-20 03:18:10	Name: uid-bp-11554 Value: k-rwPfmpTf1YSQwSFC3DyY85ypAnPBUF_BLcZmhA
ads.stickyadstv.com/	1969-12-31 23:59:59	Name: sessionId Value: 6d56bc7c1182053bb82e1d42e362

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://employeetaxrefund.com/(Line 28272) Message: Allow attribute will take precedence over 'allowfullscreen'.
security	error	URL: https://widget.groovevideo.com/widget/app.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://app.groovefunnels.com') does not match the recipient window's origin ('https://app.groove.cm').

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

175592.tracking.hyros.com
ad.360yield.com
ads.stickyadstv.com
ads.yahoo.com
ajax.googleapis.com
api.loopedin.io
app.groove.cm
app.groovefunnels.com
assets.grooveapps.com
bat.bing.com
beacon-v2.helpscout.net
c.bing.com
c.clarity.ms
cdn.productstash.io
cdn.stickyadstv.com
cdn.tooltip.io
cdnjs.cloudflare.com
cm.g.doubleclick.net
contextual.media.net
criteo-partners.tremorhub.com
criteo-sync.teads.tv
cw.addthis.com
d.turn.com
data.tooltip.io
dis.criteo.com
eb2.3lift.com
employeetaxrefund.com
exchange.mediavine.com
f.vimeocdn.com
fonts.googleapis.com
fonts.gstatic.com
fs22.formsite.com
googleads.g.doubleclick.net
gum.criteo.com
i.clarity.ms
i.liadm.com
i.vimeocdn.com
i6.liadm.com
ib.adnxs.com
idsync.rlcdn.com
jadserve.postrelease.com
ka-f.fontawesome.com
kit.fontawesome.com
match.sharethrough.com
matomo.groovetech.io
mug.criteo.com
partner.mediawallahscript.com
pixel.rubiconproject.com
player.vimeo.com
pp.signalayer.com
r.casalemedia.com
rtb-csync.smartadserver.com
s.ad.smaato.net
s.yimg.com
secure.adnxs.com
simage2.pubmatic.com
sp.analytics.yahoo.com
sslwidget.criteo.com
static.criteo.net
sync-t1.taboola.com
sync.outbrain.com
ups.analytics.yahoo.com
v1.gdapis.com
videos.groovevideo.com
widget.groovevideo.com
widget.us.criteo.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.youtube.com
x.bidswitch.net
104.111.242.245
104.90.192.189
108.157.4.72
13.248.245.213
141.226.228.48
142.250.185.130
142.250.74.194
151.101.114.109
151.101.14.109
162.159.128.61
178.250.2.146
178.250.2.151
18.210.240.141
184.30.24.121
185.64.190.80
185.86.137.133
2.18.234.233
2.20.85.164
2001:4de0:ac19::1:b:1b
2001:678:cb4:bbbb::13
212.82.100.181
2600:1f18:444a:4680:27f9:539b:c9b0:d2ce
2600:1f18:612b:4216:25d9:1223:9f5d:e330
2600:9000:2057:aa00:1b:5138:8a40:93a1
2600:9000:206f:7800:6:36e8:9f00:93a1
2600:9000:2315:5400:b:d801:7900:93a1
2606:4700:3036::6815:294
2606:4700::6811:180e
2606:4700::6812:15b4
2606:4700::6812:1734
2620:1ec:c11::200
2a00:1288:80:807::2
2a00:1450:4001:801::200e
2a00:1450:4001:808::2003
2a00:1450:4001:80e::2003
2a00:1450:4001:812::2008
2a00:1450:4001:812::200a
2a00:1450:4001:829::2002
2a00:1450:4001:829::2004
2a00:1450:4001:82a::200a
2a00:1450:4001:82a::200e
2a02:2638:1::3
2a02:2638::1c
2a06:98c1:3120::7
2a06:98c1:3121::7
2a0b:4d07:102::1
3.120.83.85
3.121.19.101
3.124.27.94
3.126.56.137
34.232.251.165
34.248.117.172
35.153.58.122
35.244.174.68
37.252.172.249
37.252.173.215
52.142.114.2
52.167.85.21
54.157.91.127
54.216.252.255
54.227.185.17
54.73.16.64
69.173.144.139
70.42.32.95
74.119.119.150
84.17.46.53
077c7d2685920baeb6b3149d52195580a502973eddcbfc6e1b3fd8bede3e477d
080e18a8c761c3d30b7ec08aa65f87109a0228367eafd0a12fcefda58d10e8ad
0982166468cc0ec6e23155f10397456c908a0599e4eac7dd0d81431843ca503f
0a43760f80608326612094f7ebbbbad42e5e24710fe8baa90d5c3684eeeaf656
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
102390511cfad271d89b358aaa0eb8ee7abab2b7361fa95c724889d57850322c
10354e9bc6b485028971a1f58fccff5c89d722db324d42bc07963aab24ebb956
11c69bcd87891a42d96e5d30f79e017f7df78fb5d1b38c172bd8499afa53314d
15281cd70032aeb02042c6f7d50f7b5312dc2e7f2b4bc700cdb29561d115a95b
19bd09a46cd5735572bec1a138df1d0c1d408767e59c890581a417bdfcd29b25
1c8894064a04f2ac7b3e03d6cb7ac9028b08bd2f24b69971319c04ef0cf5aed5
1f2518532bdaa3fd66fe386beeafee4119dddbabc01e86f332ae8df187097bc3
204a2eedfab0e8fd23a8dcceae6d93c3c824ed90ef664b45e455283ea2145a7f
2101735d43a8d486dbc5139500a78420766cc673a3610363ce9525526c3f5149
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
27badc983df1780b60c2b3fa9d3a19a00e46aac798451f0febdca52920faaddf
2c1ae13164e1fc30ddc513415b482b060b775f1bc1eb6e18a865b07101956b0b
2d97ecc3fc54beb500cfdfaab6e611f49e22c5dbaf368ede1c612e50bfd5099f
304cbbc575c227a24f183d9800167ab06418327356f73099404136d8bb9a6c92
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32bf052f6a566604ad88efa256ef360701cd270f9b4952e92577c2ebe601d9ba
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
345490564e186a5822be6706e4bb0b326bbb0fad2487eecc0d4d84ff03765d8f
34a358865a90e248b5bcc9bc1fc89c1308ae483c98a3ca7180d70b4dcfa8cc28
370b31e4f2c1d80be2fddb7ead12ed5ff81e02b36db5e297d3c2f0e039c60b68
38ba9bd69a8f6114511656eed8cf0f4e3d45d9e2c9aa0a22fb978d5da5ac250b
3dbb3a8aca8718efa36ff5141a017278211f64ffacbc876a92c8593765cacbff
3e0361122fe1fdced0bd7ae4c33f21d083f7b63a99e79a66b3111a943b160f70
401594c12a9f4a898ff4d54a395e0947d40c7dfc5fc27990661318509dfe80db
4102849464f8d41001ff6ba10d0c6f0051118e82f80738718bf49f127e2e0c13
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
470041da41d6a3dd8dd3ff17882921f6c84d873151a6566ec9f1d971b7cfe401
48fb6f0d8ac464d95cbc2df3ffa7bf5066950898c5581f5133d0565abb7f706b
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e099629cd81ad69ae59437b8d17f8c059695cc385f1493af5f3a6cce4c994f7
51f1ce6a509d26c957259cd2159a104fc59b1a883aef49071c57e04a9d157c28
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56d3bf72133f30f5e4ea2824f5906c580070865a0355d83013bc22d1849d8e42
5a00b9071e6f6fc2b7f45ee76bad85fc825037d1c0fca396462880b8378f3408
5bc2e45266401b0277b4fd26fdc5fc09eece68f3f95455432553149a9d4065dc
5c0a96a2e0c97784664302304156b2a40db0a686791e1549ab6f42acc4b8ad9a
5d7560c8b33f798d429fa0e84d88e11aff034ec7ab72a758d3ed52fc9b285a18
5fbaeb9f8e25d7e0143bae61d4b1802c16ce7390b96ceb2d498b0d96ff4c853f
6019c3c9e47dc991f8d9937deafbb0740c2e61e321324798cb508773b0814824
6240744a19f326be4e22778eb7c5a39abce05826a8728531b9fddc0a75863e8a
6b5b6dbacd834c25f8b7eecd19cae92f3d6ee6c14c2efffaeb7e6e0494a8d979
6b96faebeb046cd5224e65c3b937adccb309098c3f5437f997c2428353eaa9a1
6cdefb09aa8ed6fcfcb5ee50239a85d38f1a700653ce9f0420878508c07925ea
6d50c567ed88aa1b2fb780460c18cb842669611508d308c7d9e9388b334c909d
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d
7a7249a1f634a0ecfc772e774a158a0ab74c354609558c382b130bf37a91b346
7b47ae80afa3203ba35b6f17e9a9c0641ac3f8f5d37b3ae9f01f06730b1e7ae6
7bf94b0d401ae094f5888c0f504655e1945588cafdeecf952538b5f0d0b26639
7d912a263857902d3ebb8ef4a4639ff2c758379fc1c64cb63622081a6402efb1
7f8b63bff49fba3c5bae30f4eb39f2fd6d088fbe9d7292bdf37b0ef4a1ec68d6
832f63f4187160c195b04f1911c2e623a75e805f4b23abb9b0bea214b4283a43
8349d9a9ffc87ffcdb0f6671e9d9709d7e4aa6cd851628ae81d294ab4001189d
85092d1f9cbaf7e078690e5e96ec46660608381b11b6405ef0c254c1717f84c5
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
85635df68b8d195f5bd3b84eae58eb6bbef45ae3a8b6735860db715337f2e806
87608a8dea58460e4b38f3445a737f999eb6a62dee361be55e06625d505c4e5c
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
91f94a3c7e05d1c1afd01260e88ebea5be6720ed3514c7a82bba96a33d4d6b21
920a7ef190e90b9a9de83b62bd36c4556d490ef464e60f874996d6c2e4cf7764
9221b2c07e1ad6a168982f0fbb342131b2e96c0ebe5902d98653d3a546a34632
9338e65fc077355c7a87ae0d64cc101e23b9bf8ad78ae65f0f319c857311b526
933d58802077f5ce49cd2b3c8706923d24bcb02651fab7964f7b583615ae44e4
935724f2a78927b9d3a7ac543c34c66e6a86d3c57249ba176f5b582ba7c8071c
96e7467fa6eec2a64b2403a170731e21cce55dbbeff67055de09736b78246188
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9bf76c0981f3d7cb30be16f19b1419bad27dbccc3c5c5496cd1c84982e756dd8
9c0c9a4f30d5474fd68e2242edb082b8300ef5876fd3405f1d4fbbe9127a8b56
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
aa1cf79fdb89e6ff28f4e17e1472de5fecb60884ab4625b01b5329ee6e7465b8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b375f9bd0355659321e5d71a79f29b1bd92c35983937a27aaa387e7b66b1fc2d
b558de5c9eefc9189ce63df5c4d1bfe9932660fd3f013c5c676df0814e952c6f
b9dff679ff9931afbbb8019d522a7d03d7787a7d7818037d48f3a502c652e2b6
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
c0e586d1a0a78ea724d41da0cdff0346245344d3aebf9e61d575e3515a8aa807
c0e5ae6bdbd6cc1a2a13e17aeb81bfe8c6c4da8a3c198c26513c5305e404a479
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c177e9c84d392f24927bacc3365c8bb1515707a3c5dc159c14ab35a23d660a14
c388b25912be53e9f3dd747c322f90f507521d61899763ee8d232c8cb919abae
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa
caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
d622d40ae1e8015c10ca7738ddad1e3963cc495922acc38cec16a57f9bd99a98
d653caafed24eae5bf173c7ab2ee4a42aeab1a72103538ae1cdb8202aab19723
d72a0fbde35c547caabc6cfaa2c6a9f4d60653d96f38a5fe6e064fe7c7e9ab7c
dc41ffc9fb33501fcf5cb49b44c77dad397e6cb813ecb11ff30e3759bafac9ea
e17cc900f2c3e8e09d3a2d454c231fccc85c4d1c6164b05c1d5c482a51d21190
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6fe608076a26c25128ade42e19548ebc9b56ec208f743d671b096d860ab9446
eefcaed1e731e6269947209c907c643e8801654b1e6057d309cfbcdc790dd0ac
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f61d0efe366479ed9a5c08ca2289d1fd9b912a4070bc4aec4206559f20677c44
f62806478a7a3181148a139c0873391c208d834b3650ed4f04edc75dca910c66
f9b751c1cd0d2b0f91862db987fed9dda48758b15e6f42ca67796b45f4b21702
faa7999a9bc916746448d20ba389c7360faea9bc01a9e53fc08275e565cbf399
fb85fd71f83ed28e90ba1fa593ddd510122b4c525c34536c1e8016ba06b7658d
fbfe54a0e52908626c069d2c012626ddb5cccd3989c1057156a36ee2fae89f04
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda
fdb72fa6bec57bc4fdaa33ce375fa88d69fa6b6888279375826ea6e3f0ae609b
fe096c1a1b3636490559c3e3d5c51dedcfed669ef95394071a765d922937dc6d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

employeetaxrefund.com Open in urlscan Pro 2606:4700:3036::6815:294 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

147 Requests

88 %HTTPS

41 %IPv6

56 Domains

73 Subdomains

62 IPs

9 Countries

8970 kBTransfer

23692 kBSize

56 Cookies

1 Outgoing links

Redirected requests

147 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

employeetaxrefund.com Open in urlscan Pro
2606:4700:3036::6815:294 Public Scan

Screenshot
Live screenshot

Full Image

147
Requests

88 %
HTTPS

41 %
IPv6

56
Domains

73
Subdomains

62
IPs

9
Countries

8970 kB
Transfer

23692 kB
Size

56
Cookies

147 HTTP transactions
0 data transactions